Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

A Cross-site scripting XSS vulnerability in the Portal Search module before 6.0.12 from Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the tag...

PT-2022-25149 · Unknown · Monikabrzica Scm

Name of the Vulnerable Software and Affected Versions: MonikaBrzica scm affected versions not specified Description: A critical issue has been found in MonikaBrzica scm, affecting some unknown functionality of the file upis u bazu.php. The manipulation of the email, lozinka, ime, or id arguments...

PT-2022-7392 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.4 Description: The issue is related to improper input validation in the GLPI system, which can be exploited by a remote attacker to impact the system's integrity. Users may be able to inject custom field values in...

CVE-2022-3798

A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-2126...

jQuery UI Cross-site Scripting (CVE-2016-7103)

A cross-site scripting vulnerability exists in jQuery UI. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

CVE-2016-20017

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022...

CVE-2022-42112

A Cross-site scripting XSS vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted paylo...

The vulnerability of the CERT/CC VINCE software coordination mechanism lies in its lack of measures to neutralize special elements, allowing attackers to inject arbitrary HTML code.

The vulnerability of the CERT/CC VINCE software coordination mechanism exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code remotely, using the “Product Affected” field...

Simple Cold Storage Management System SQL注入漏洞

Simple Cold Storage Management System is a cold storage management system. Simple Cold Storage Management System /csms/classes/Master.php?f=deletemessage SQL injection vulnerability can be exploited by a remote attacker to submit a specially crafted SQL request to manipulate a database, obtain...

Smart eVision 跨站脚本漏洞

Smart eVision Information Technology Smart eVision is a business intelligence platform of China Union Quan Information Technology Smart eVision Information Technology Company. It can integrate business management rooms, dashboards, reports, and input interfaces for business operations management...

Hospital Information System SQL注入漏洞

Hospital Information System is a hospital information management system organized by SourceCode and Projects. A SQL injection vulnerability exists in Hospital Information System version 1.0 that originates from a remote SQL injection that allows bypassing authentication...

CVE-2022-30604

Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors...

Apartment Visitor Management System SQL注入漏洞

Apartment Visitor Management System is an Apartment Visitor Management System by Carlo Montero Personal Developer. Apartment Visitor Management System suffers from a SQL injection vulnerability that stems from some unknown functionality in the file action-visitor.php being affected, where...

Online Class and Exam Scheduling System SQL注入漏洞

Online Class and Exam Scheduling System is an online class and exam scheduling system. Online Class and Exam Scheduling System 1.0 suffers from a SQL injection vulnerability that originates from an unknown function in the file /pages/facultysched.php being affected. The operation parameter facult...

PT-2022-18025 · Sourcecodester · Sourcecodester Garage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Garage Management System affected versions not specified Description: A critical issue has been found in the SourceCodester Garage Management System, allowing for SQL injection through the manipulation of the userName/uemail...

CVE-2016-15004

A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. ...

CVE-2016-15004 InfiniteWP Client Plugin injection

A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. ...

Revmakx InfiniteWP Client Plugin 注入漏洞

Revmakx InfiniteWP Client Plugin is a self-hosted system from Revmakx India. Allows users to manage an unlimited number of WordPress sites from their own server. An injection vulnerability exists in Revmakx InfiniteWP Client Plugin version 1.5.1.3/1.6.0, the vulnerability stems from the affected ...

TypeORM SQL注入漏洞

TypeORM TypeORM is an excellent Node.js ORM framework. The goal of the software is to maintain support for the latest Javascript features; with the following features: 1 to provide one-to-one, many-to-one, one-to-many, many-to-many relational processing of tables; 2 to help develop a variety of...

WordPress Plugin WP-Filebase Download Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Plugin WP-Filebase Download Manager version 3.4.4 contains a cross-site scripting...