1242 matches found
CVE-2018-5479
FoxSash ImgHosting 1.5 according to footer information is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By...
CVE-2017-14594
The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the jqlQuery query parameter...
CVE-2017-17937
Vanguard Marketplace Digital Products PHP has XSS via the phpsquery parameter to /search...
CVE-2017-17893
Readymade Video Sharing Script has XSS via the searchvideo.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter...
CVE-2017-17871
The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action, or the ques-srch parameter...
Design/Logic Flaw
Readymade Video Sharing Script has XSS via the searchvideo.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter...
Sql injection
Readymade Video Sharing Script has SQL Injection via the viewsubs.php chnlid parameter or the searchvideo.php search parameter...
JEXTN Question And Answer extension SQL Injection Vulnerability
Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other functions.JEXTN Question And Answer extension is used in one of the online question and answer plug-ins. A SQL injection vulnerability...
CVE-2017-17892
Readymade Video Sharing Script has SQL Injection via the viewsubs.php chnlid parameter or the searchvideo.php search parameter...
CVE-2017-17893
Readymade Video Sharing Script has XSS via the searchvideo.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter...
Techno - Portfolio Management Panel Cross-Site Scripting Vulnerability
Techno - Portfolio Management Panel is a set of portfolio management panel scripts. A cross-site scripting vulnerability exists in Techno - Portfolio Management Panel 2017-11-16 and earlier versions. A remote attacker can exploit the vulnerability by sending the 's' parameter to the...
Techno - Portfolio Management Panel Information Disclosure Vulnerability
Techno - Portfolio Management Panel is a set of portfolio management panel scripts. An information disclosure vulnerability exists in Techno - Portfolio Management Panel 2017-11-16 and earlier versions. An attacker can exploit the vulnerability by sending an invalid 's' parameter to the...
CVE-2017-17694
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter...
CVE-2017-17694
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter...
CVE-2017-17695
Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter...
Design/Logic Flaw
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter...
CVE-2017-17695
Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter...
CVE-2017-5663
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to...