gortex-PoC

インデクサーのファイル走査におけるシンボリックリンク追跡 → searchtext によるリポジトリ外コンテンツの開示 CVE ステータス: 申請済み、割り当て待ち。この脆弱性は GHSA-6vhf-4wcm-2r83 として公開されています。CVE が割り当てられると、このリポジトリは CVE-YYYY-NNNNN-gortex-PoC に改名され、このバナーは CVE リンクに置き換えられます。 | ---|--- 研究者| Dostxodjayev Abdullox @squeeze440 アドバイザリ| GHSA-6vhf-4wcm-2r83 CVSS 3.1| 5.5 Medi...

CVE-2025-10592: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of the component POST Parameter Handler. Such manipulation of the argument searchfield/searchtext leads to sql injection. The attack may be...

CVE-2021-25030

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

WordPress Plugin Events Made Easy SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Events Made Easy. The vulnerability stems from the program not properly filtering and...

CVE-2021-25030: Improper Neutralization of Special Elements used in an SQL Command

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

apons.eu XSS vulnerability

Open Bug Bounty ID: OBB-669839 Description| Value ---|--- Affected Website:| apons.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

lismusica.pt XSS vulnerability

Open Bug Bounty ID: OBB-320210 Description| Value ---|--- Affected Website:| lismusica.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Sql injection

SQL injection vulnerability in system/application/controllers/catalog.php in Zoki Soft Zoki Catalog aka Smart Catalog allows remote attackers to execute arbitrary SQL commands via the searchtext parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-2097: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in system/application/controllers/catalog.php in Zoki Soft Zoki Catalog aka Smart Catalog allows remote attackers to execute arbitrary SQL commands via the searchtext parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-2180

Multiple SQL injection vulnerabilities in cpLinks 1.03, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 adminusername parameter aka the username field to admin/index.php and the 2 searchtext and 3 searchcategory parameters to search.php. NOTE:...

CVE-2008-2181

Multiple cross-site scripting XSS vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 searchtext and 2 searchcategory parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtain...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 searchtext and 2 searchcategory parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtain...

CVE-2008-2180

Multiple SQL injection vulnerabilities in cpLinks 1.03, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 adminusername parameter aka the username field to admin/index.php and the 2 searchtext and 3 searchcategory parameters to search.php. NOTE:...

CVE-2008-2180: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in cpLinks 1.03, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 adminusername parameter aka the username field to admin/index.php and the 2 searchtext and 3 searchcategory parameters to search.php. NOTE:...

CVE-2008-2181: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 searchtext and 2 searchcategory parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtain...

CVE-2004-0304: Undefined Security Weakness

SQL injection vulnerability in browseitems.asp in WebCortex WebStores 2000 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the SearchText parameter...