Sql injection

EARCLINK ESPCMS-P8 was discovered to contain a SQL injection vulnerability in the espcmsweb/Search.php component via the attrarray parameter. This vulnerability allows attackers to access sensitive database information...

CVE-2020-18917

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

CVE-2020-18917: Cross-Site Request Forgery (CSRF)

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

PT-2021-10255

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 SP2 Description: The issue allows remote attackers to execute arbitrary PHP code via the typename parameter in the plus/search.php component. This is possible because the contents of typename.inc are under an attacker's...

PT-2021-10254

Name of the Vulnerable Software and Affected Versions: EARCLINK ESPCMS-P8 affected versions not specified Description: The issue is related to a SQL injection vulnerability in the espcms web/Search.php component. This vulnerability is exploited via the attr array parameter, allowing attackers to...

CVE-2020-18913: Improper Neutralization of Special Elements used in an SQL Command

EARCLINK ESPCMS-P8 was discovered to contain a SQL injection vulnerability in the espcmsweb/Search.php component via the attrarray parameter. This vulnerability allows attackers to access sensitive database information...

CVE-2021-39599

Multiple Cross Site Scripting XSS vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in 1 public/search.php and in the 2 c parameter in admin.php...

CVE-2021-39599

CVE-2021-39599 affects CXUUCMS 3.1, with multiple XSS vulnerabilities in public/search.php (search parameter) and admin.php (c parameter). The root cause is unsanitized input leading to client-side code execution. Impact is documented as XSS with potential impact on confidentiality/integrity depe...

CVE-2021-39599: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in 1 public/search.php and in the 2 c parameter in admin.php...

PT-2021-22671

Name of the Vulnerable Software and Affected Versions: CXUUCMS version 3.1 Description: Multiple Cross Site Scripting XSS vulnerabilities exist in CXUUCMS. The vulnerabilities are found in the search and c parameters in "public/search.php" and in the c parameter in "admin.php". Recommendations: F...

CVE-2021-37390

A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI social network search feature...

CVE-2021-37390: Improper Neutralization of Input During Web Page Generation

A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI social network search feature...

PT-2021-21630

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.14 Description A reflected XSS issue exists in the social network search feature, specifically in the "main/social/search.php" endpoint with the q URI parameter. This allows for potential exploitation. Recommendations...

CVE-2021-37391: Improper Neutralization of Input During Web Page Generation

A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social...

PT-2021-3968

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.14 Description The issue allows a user without privileges to send an invitation message to another user, such as the administrator, through main/social/search.php and main/inc/lib/social.lib.php, potentially stealing...

CVE-2021-26224

Cross-site scripting XSS vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php...

CVE-2021-26224

Cross-site scripting XSS vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php...

Cross site scripting

Cross-site scripting XSS vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php...

CVE-2021-26224

Cross-site scripting XSS vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php...

CVE-2021-26224

CVE-2021-26224 : A cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS v1.0 allows remote attackers to inject arbitrary web script or HTML via the search field (search.php). The connected references confirm the affected product/version and the input vector, but no detail...