685 matches found
CVE-2022-24992
A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal...
Ambit Technologies Itech Movie Portal Script SQL注入漏洞
Ambit Technologies Itech Movie Portal Script is a Movie Portal Script from Ambit Technologies, USA. An SQL injection vulnerability exists in Ambit Technologies Itech Movie Portal Script version 7.36, which stems from an unknown function in shownews.php, where manipulation of the parameter id can...
Ambit Technologies Itech Movie Portal Script 安全漏洞
Ambit Technologies Itech Movie Portal Script is a Movie Portal Script from Ambit Technologies, USA. A security vulnerability exists in Ambit Technologies Itech Movie Portal Script version 7.36, which stems from some unknown functionality in movie.php, where manipulation of the parameter f can lea...
CVE-2022-28612
Improper Access Control vulnerability leading to multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Muneeb's Custom Popup Builder plugin = 1.3.1 at WordPress...
CVE-2022-28479
SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu...
Rescue Dispatch Management System SQL注入漏洞
Rescue Dispatch Management System is a rescue dispatch management system from Carlo Montero's personal developer. rescue dispatch management system v1.0 is vulnerable to SQL injection, which originates from /rdms/classes/ Master.php?f=deletereport page lacks validation of externally entered SQL...
WordPress plugin Simple Real Estate Pack 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Simple Real Estate Pack plugin 1.4.8 and earlier versions are vulnerable to a cross-site...
CVE-2022-30286
pyscriptjs aka PyScript Demonstrator in PyScript through 2022-05-04 allows a remote user to read Python source code...
CVE-2022-1445
Stored Cross Site Scripting vulnerability in the checkedoutto parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie...
CVE-2022-28420
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via BabyCare/admin.php?id=theme&setid=...
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...
Jenkins Extended Choice Parameter Plugin跨站脚本漏洞
Jenkins and Jenkins Plugin are both products of Jenkins. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The vulnerability stems from the plugin's failure to escape the value and description ...
CVE-2021-24994
The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue...
CVE-2022-25404
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETESTR parameter...
CVE-2021-44317
In Bus Pass Management System v1.0, parameters 'pagedes' and About Us are affected with a Stored Cross-site scripting vulnerability...
Chamilo LMS SQL注入漏洞
Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, remote training, and online question answering. chamilo LMS is vulnerable to a SQL injection vulnerability that originates in the main...
CVE-2021-41862
AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library BCEL...
CVE-2021-40923
Cross-site scripting XSS vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the email parameter...
CVE-2021-39278
Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3...