CVE-2023-28424: Improper Neutralization of Special Elements used in an SQL Command

Soko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, Search and SearchFeed, implemented in pkg/app/handler/packages/search.go, are affected by a SQL injection via the q parameter. As a result, unauthenticated attackers can execute arbitrary SQ...

Online Doctor Appointment Booking System SQL注入漏洞

Online Doctor Appointment Booking System is an open source online doctor appointment booking system. The Online Doctor Appointment Booking System suffers from a SQL injection vulnerability that originates from allowing an attacker to obtain sensitive information via the q parameter of the...

CVE-2020-29168: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via the q parameter to the getuser.php endpoint...

CVE-2022-46888: Improper Neutralization of Input During Web Page Generation

Multiple reflective cross-site scripting XSS vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q paramete...

PT-2023-15095 · Nexusphp · Nexusphp

Name of the Vulnerable Software and Affected Versions: NexusPHP versions prior to 1.7.33 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to reflective cross-site scripting XSS attacks. This can be achieved by injecting malicious input int...

PT-2023-16181 · Unknown · Theradsystem

Name of the Vulnerable Software and Affected Versions: saemorris TheRadSystem affected versions not specified Description: A problematic issue has been identified, affecting an unknown function of the file users.php. The manipulation of the q argument leads to cross-site scripting. This issue can...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. in the United States. A security vulnerability exists in Enhancesoft osTicket versions prior to 1.16.4. The vulnerability stems from setting an ordinary user's username as the XSS payload, and then placing the same XSS...

PT-2022-25072 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe affected versions not specified Description: A problematic issue was found in Frappe, affecting some unknown functionality of the file frappe/templates/includes/navbar/navbar search.html of the component Search. The manipulation of the...

CVE-2022-25303: Improper Neutralization of Input During Web Page Generation

The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting XSS via the query string parameter q. In the case where it does not contain the http string, it is used to build the errormessage that is then rendered in the error.html template, using the flask.rendertemplate functio...

PT-2022-17199

Name of the Vulnerable Software and Affected Versions whoogle-search versions prior to 0.7.2 Description The issue concerns Cross-site Scripting XSS via the query string parameter q. When the q parameter does not contain the 'http' string, it is used to build the error message that is then render...

GHSA-CX2V-JRJC-G54W OpenTSDB vulnerable to OS Command Injection

An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...

Apache Jackrabbit contains Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

GHSA-6FXV-38XC-H866 Apache Jackrabbit contains Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

CVE-2020-18324

Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template...

CVE-2020-18324

Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template...

CVE-2020-18324: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template...

PT-2021-21630

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.14 Description A reflected XSS issue exists in the social network search feature, specifically in the "main/social/search.php" endpoint with the q URI parameter. This allows for potential exploitation. Recommendations...

CVE-2020-22200

Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to publicgetsuggestkeyword...

PT-2021-10744

Name of the Vulnerable Software and Affected Versions phpCMS version 9.1.13 Description The issue is related to a Directory Traversal vulnerability. It can be exploited via the q parameter to the "public get suggest keyword" endpoint. Recommendations For phpCMS version 9.1.13, consider restrictin...

CVE-2020-22200: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to publicgetsuggestkeyword...