CVE-2024-21667: Improper Access Control

pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not...

PT-2024-19009

Name of the Vulnerable Software and Affected Versions pimcore/customer-data-framework versions prior to 4.0.6 Description An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are...

PT-2023-26648 · Unknown · Campcodes Beauty Salon Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Beauty Salon Management System version 1.0 Description: A vulnerability was found in the system, affecting an unknown functionality of the file /admin/search-appointment.php. The manipulation of the searchdata argument leads to...

CVE-2023-27213

Online Student Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /eduauth/student/search.php...

PT-2023-14812 · Unknown · Phpgurukul Doctor Appointment Management System

Name of the Vulnerable Software and Affected Versions: phpgurukul Doctor Appointment Management System version 1.0.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the searchdata variable. Recommendations: For phpgurukul Doctor Appointment...

CVE-2022-31382

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php...

Google Tag Manager for WordPress < 1.15.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the s parameter before outputting it back in a page when the search data is included in the data layer related settings is Basic data Search data...

GHSA-G7PJ-3V97-3VXP Pimcore Vulnerable to PHP Object Injection Attacks

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...

IDOR in Teams API in Grafana

Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. /teams/:teamId will allow an authenticated attacker to view unintended data by querying for the specific team ID,...

CVE-2021-39411

Multiple Cross Site Scripting XSS vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the 1 searchdata parameter in a doctor/search.php and b admin/patient-search.php, and the 2 fromdate and 3 todate parameters in admin/betweendates-detailsreports.php...

Online Marriage Registration System SQL Injection Vulnerability

Online Marriage Registration System is a website builder that supports online marriage registration. A SQL injection vulnerability exists in Online Marriage Registration System version 1.0, which stems from a lack of validation of the searchdata parameter of the search.php request against an...

Phpgurukul Online Marriage Registration System SQL注入漏洞

Online Marriage Registration System is a website builder that supports online marriage registration. A SQL injection vulnerability exists in Online Marriage Registration System version 1.0, which stems from a lack of validation of the searchdata parameter of the search.php request against an...

PT-2014-6348

Name of the Vulnerable Software and Affected Versions Novell eDirectory versions prior to 8.8 SP8 Patch 4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the rdn parameter in the nds/search/data component of iMonitor...

CVE-2014-2921

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...

Design/Logic Flaw

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...

CVE-2014-2921

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...

PT-2011-5070

Name of the Vulnerable Software and Affected Versions Parallels Plesk Panel version 10.2.0 build 20110407.20 Description The issue allows remote attackers to obtain sensitive information by exploiting a "cross-domain Referer leakage" in the Control Panel. This is achieved by reading web-server...

PT-2009-6399 · Testlink Team · Testlink

Name of the Vulnerable Software and Affected Versions: TestLink versions prior to 1.8.5 Description: The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the req parameter to "login.php", and allows remote authenticated users to inject arbitra...

PT-1999-1526 · Disney · Disney Go Express

Name of the Vulnerable Software and Affected Versions: Disney Go Express affected versions not specified Description: The issue allows remote attackers to access and modify search information for users by connecting to an HTTP server on the user's system. Recommendations: At the moment, there is ...