CVE-2023-49954

The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address...

CVE-2023-49954: Improper Neutralization of Special Elements used in an SQL Command

The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address...

CVE-2023-38769

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php...

Atlas Business Directory Listing Cross-site Scripting Vulnerability

codecanyon Atlas Business Directory Listing is a system by codecanyon, Inc. A cross-site scripting vulnerability exists in Creativeitem Atlas Business Directory Listing version 2.13, which stems from a cross-site scripting XSS vulnerability in the parameter searchstring...

Atlas Business Directory Listing 2.13 Cross Site Scripting

Exploit Title: Atlas Business Directory Listing 2.13 - Reflected XSS Exploit Author: CraCkEr Date: 09/07/2023 Vendor: Creativeitem Vendor Homepage: https://creativeitem.com/ Software Link: https://demo.creativeitem.com/atlas/ Tested on: Windows 10 Pro Impact: Manipulate the content of the site...

GHSA-GJ2J-PPJQ-9PJG Moodle Cross-site scripting (XSS) vulnerability in course management search

Cross-site scripting XSS vulnerability in the searchpagination function in course/classes/managementrenderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string...

CVE-2020-22986

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2020-8893

An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp...

Code injection

An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp...

CVE-2020-8893

An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp...

PT-2020-7643

Name of the Vulnerable Software and Affected Versions web2Project versions 3.1 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the search string parameter in the contacts module to "index.php" or by remote attackers v...

PT-2019-13623

Name of the Vulnerable Software and Affected Versions TemaTres version 3.0 Description The issue is related to reflected XSS. It can be triggered via the replace string or search string parameter to the "vocab/admin.php?doAdmin=bulkReplace" API endpoint. Recommendations For TemaTres version 3.0,...

CVE-2018-19828

Artica Integria IMS 5.0.83 has XSS via the searchstring parameter...

PT-2018-15117

Name of the Vulnerable Software and Affected Versions Artica Integria IMS version 5.0.83 Description The issue allows for XSS via the search string parameter. Recommendations For Artica Integria IMS version 5.0.83, avoid using the search string parameter until the issue is resolved...

PT-2016-7720

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue allows remote attackers to read database information. This is achieved by exploiting the search string parameter in the "action=search&module=search" API endpoint. Recommendations For Exponent C...

CVE-2016-0725

Cross-site scripting XSS vulnerability in the searchpagination function in course/classes/managementrenderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string...

Cross site scripting

Cross-site scripting XSS vulnerability in the searchpagination function in course/classes/managementrenderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string...

PT-2016-1310

Name of the Vulnerable Software and Affected Versions Moodle versions 2.8.x through 2.8.9 Moodle versions 2.9.x through 2.9.3 Moodle versions 3.0.x through 3.0.1 Description A cross-site scripting XSS issue exists due to insufficient protection of the web page structure. This allows remote...