abasolo.mexicored.com.mx XSS vulnerability

Open Bug Bounty ID: OBB-454118 Description| Value ---|--- Affected Website:| abasolo.mexicored.com.mx Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventio...

CVE-2017-17696

Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php...

CVE-2017-17695

Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter...

CVE-2017-17695

The CVE concerns Techno - Portfolio Management Panel with a SQL Injection vulnerability in the panel/search.php s parameter (affecting versions up to 2017-11-16). The CNVD entry explicitly describes a remote attacker manipulating the s parameter to execute SQL commands and potentially disclose da...

CVE-2017-17694

Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter...

Website Auction Marketplace SQL Injection Vulnerability

Website Auction Marketplace is a software for creating e-commerce websites. A SQL injection vulnerability exists in Website Auction Marketplace version 2.0.5. The vulnerability can be exploited by remote attackers to inject SQL commands by sending the 'catid' parameter to the search.php file...

PT-2017-14955

Name of the Vulnerable Software and Affected Versions Techno - Portfolio Management Panel versions prior to 2017-11-16 Description The issue allows SQL Injection via the panel/search.php endpoint, specifically through the s parameter. Recommendations For versions prior to 2017-11-16, update to a...

CVE-2017-17695: Improper Neutralization of Special Elements used in an SQL Command

Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter...

CVE-2017-17696: Exposure of Sensitive Information to an Unauthorized Actor

Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php...

PT-2017-14954

Name of the Vulnerable Software and Affected Versions Techno - Portfolio Management Panel versions prior to 2017-11-16 Description The issue allows for XSS via the s parameter in the "panel/search.php" endpoint. Recommendations For versions prior to 2017-11-16, update to a version released after...

CVE-2017-17694: Improper Neutralization of Input During Web Page Generation

Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter...

PT-2017-14956

Name of the Vulnerable Software and Affected Versions Techno - Portfolio Management Panel versions prior to 2017-11-16 Description The issue allows full path disclosure via an invalid s parameter to the "panel/search.php" endpoint. Recommendations For versions prior to 2017-11-16, consider...

CVE-2017-17592

Website Auction Marketplace 2.0.5 has SQL Injection via the search.php catid parameter...

CVE-2017-17592

Website Auction Marketplace 2.0.5 has SQL Injection via the search.php catid parameter...

Sql injection

Website Auction Marketplace 2.0.5 has SQL Injection via the search.php catid parameter...

CVE-2017-17573

FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php categoryid or subcategoryid parameter...

Sql injection

FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php categoryid or subcategoryid parameter...

CVE-2017-17592

Website Auction Marketplace 2.0.5 has SQL Injection via the search.php catid parameter...

CVE-2017-17573

FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php categoryid or subcategoryid parameter...

CVE-2017-17592

Website Auction Marketplace 2.0.5 contains an SQL injection in the search.php cat_id parameter. The issue allows remote attackers to manipulate SQL queries, enabling potential data leakage or modification (per sources listed). The CVE is corroborated by multiple databases (NVD, CNVD, CVE.gov) wit...