PT-2024-37636 · Unknown · Hyperview Geoportal Toolkit

Name of the Vulnerable Software and Affected Versions: HyperView Geoportal Toolkit versions prior to 8.5.0 Description: The issue allows an unauthenticated remote attacker to prepare links that, when opened, will load scripts from a remote location controlled by the attacker and execute them in t...

ItSourceCode 'Online Blood Bank Management System in PHP" Stored XSS

Stored XSS in Online Blood Bank Management System V1.0...

CVE-2023-49111

For Kiuwan installations with SSO single sign-on enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is...

CVE-2024-4817: Improper Control of Resource Identifiers

A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file manageuser.php of the component HTTP Request Parameter Handler. The manipulation of the argument id leads to improper control of resourc...

CVE-2024-4817 Campcodes Online Laundry Management System HTTP Request Parameter manage_user.php resource injection

A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file manageuser.php of the component HTTP Request Parameter Handler. The manipulation of the argument id leads to improper control of resourc...

Navidrome 安全漏洞

Navidrome is a web-based open source music collection server and streamer. It is used to freely listen to music collections from any browser or mobile device. A security vulnerability exists in Navidrome 0.51.1 and earlier versions, which stems from a vulnerability that allows an attacker to...

CVE-2024-31507

Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "request" parameter in admin/fetchgendercs.php...

CVE-2024-31507

Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "request" parameter in admin/fetchgendercs.php...

PT-2024-24127 · Unknown · Sourcecodester Online Graduate Tracer System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Graduate Tracer System version 1.0 Description: The issue concerns SQL Injection via the request parameter in the "admin/fetch gendercs.php" API endpoint. This allows for potential manipulation of database queries...

Uncontrolled Resource Consumption

Liferay Portal is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to reliance on a request parameter to limit file size, enabling remote authenticated users to upload excessively large files to the system's temp folder by altering the 'maxFileSize' parameter...

Improper Check For Unusual Or Exceptional Conditions

Mattermost is vulnerable to Denial Of Service. The vulnerability is due to there is no proper validation for the type of the "reminder" body request parameter. This allows an attacker to crash the Playbook Plugin when updating the status dialog...

Liferay Portal vulnerable to Denial of Service

The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, whic...

jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()

A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable...

jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()

A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable...

CVE-2024-0509

The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2024-15625 · WordPress · Wp 404 Auto Redirect To Similar Post

Name of the Vulnerable Software and Affected Versions: WP 404 Auto Redirect to Similar Post plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is related to Reflected Cross-Site Scripting via the request parameter due to insufficient input sanitization and output...

CVE-2024-0509: Improper Neutralization of Input During Web Page Generation

The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Cross site scripting

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests...

CVE-2023-6838

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests...

CVE-2023-6838

The CVE-2023-6838 entry describes a reflected Cross-Site Scripting vulnerability in the Authentication Endpoint of WSO2 API Manager. An attacker can tamper a request parameter to execute script in the context of a victim’s browser, with impact limited to confidentiality and integrity (per CVSS: L...