PaulShop 'q' Parameter SQL Injection Vulnerability

PaulShop is a shopping cart web system. A SQL injection vulnerability exists in the PaulShop 'q' parameter. This allows attackers to exploit the vulnerability to obtain sensitive information...

SQL Injection

github.com/gogits/gogs is vulnerable to SQL injection attacks. These attacks are possible because the q parameter is not correctly handled...

PT-2017-16445

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.6.2 Description An issue was discovered in the findChildrenByFilter function, which is called by the web-accessible path /categoriesServlet. This function performs string interpolation and direct SQL query execution...

DotCMS SQL Injection Vulnerability (CNVD-2017-01933)

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build . A SQL injection vulnerability exists in categoriesServlet in DotCMS versions prior to 3.6.1. A remote attacker can explo...

countyoffice.org XSS vulnerability

Vulnerable URL: http://www.countyoffice.org/?q="+alert'O+\nP+\nE\nN+\nB\nU+\nG\nB+\nO\nU+\nN\nT+\nY';...

Chaudic Cross-Site Scripting Vulnerability

Chaudic is a professional retail management software. A cross-site scripting vulnerability exists in the q parameter of the search page in Chaordic version 1.1, which stems from the program failing to adequately filter user-submitted input. An attacker could use this vulnerability to steal...

CVE-2016-6523: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

Diasite CMS Cross-Site Scripting Vulnerability

Diasite CMS is a web management tool that provides multiple services. Cross-site scripting vulnerabilities exist in the q parameter of the Rechercher-14-0-0-0.html page of Diasite CMS that stem from the program failing to adequately filter user-submitted input. An attacker could exploit these...

ImageMagick Arbitrary Process Data Read Vulnerability

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. There is a security vulnerability in ImageMagick. An attacker can exploit this vulnerability to read arbitrary process...

Parsijoo Cross Site Scripting

================================================================================ Cross Site Scripting on Search Engine Parsijoo ================================================================================ Author: bl4ckmohajem [email protected] home page : http://www.parsijoo.ir/...

Vulnerability in OpenSSL - DH small subgroups

Historically OpenSSL usually only ever generated DH parameters based on “safe” primes. More recently in version 1.0.2 support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be “safe”. Where an application ...

PT-2015-7403

Name of the Vulnerable Software and Affected Versions Joomla! component com googlesearch cse version 3.0.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the q parameter to "index.php". Recommendations For version 3.0.2, avoid using...

CVE-2015-6919: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the googleSearch CSE comgooglesearchcse component 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the q parameter to index.php...

CVE-2015-5066: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 content or 2 title field in an add action in the posts page to index.php or the 3 q parameter in the posts page to index.php...

PT-2015-6764

Name of the Vulnerable Software and Affected Versions GeniXCMS version 0.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the content or title field in an add action in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Ultimate PHP Board aka myUPB before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 q parameter to search.php or 2 avatar parameter to profile.php...

CVE-2015-2217

Multiple cross-site scripting XSS vulnerabilities in Ultimate PHP Board aka myUPB before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 q parameter to search.php or 2 avatar parameter to profile.php...

CVE-2015-2217: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Ultimate PHP Board aka myUPB before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 q parameter to search.php or 2 avatar parameter to profile.php...

WordPress Plugin Pixabay Images Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Pixabay Images is one of the support for selecting photos from Pixabay image material sharing network in the CC0...

Cross site scripting

Cross-site scripting XSS vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/...