gortex-PoC

인덱서 파일 순회에서의 심볼릭 링크 추적 → searchtext를 통한 저장소 외부 콘텐츠 노출 CVE 상태: 요청됨, 할당 대기 중. 이 발견은 GHSA-6vhf-4wcm-2r83으로 공개되었습니다. CVE가 할당되면 이 저장소는 CVE-YYYY-NNNNN-gortex-PoC로 이름이 변경되고 이 배너는 CVE 링크로 대체됩니다. | ---|--- 연구자| Dostxodjayev Abdullox @squeeze440 권고| GHSA-6vhf-4wcm-2r83 CVSS 3.1| 5.5 Medium 취약점| CWE-59,...

CVE-2025-10592: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of the component POST Parameter Handler. Such manipulation of the argument searchfield/searchtext leads to sql injection. The attack may be...

CVE-2021-25030

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

WordPress Plugin Events Made Easy SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Events Made Easy. The vulnerability stems from the program not properly filtering and...

CVE-2021-25030: Improper Neutralization of Special Elements used in an SQL Command

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

apons.eu XSS vulnerability

Open Bug Bounty ID: OBB-669839 Description| Value ---|--- Affected Website:| apons.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

lismusica.pt XSS vulnerability

Open Bug Bounty ID: OBB-320210 Description| Value ---|--- Affected Website:| lismusica.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Sql injection

SQL injection vulnerability in system/application/controllers/catalog.php in Zoki Soft Zoki Catalog aka Smart Catalog allows remote attackers to execute arbitrary SQL commands via the searchtext parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-2097: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in system/application/controllers/catalog.php in Zoki Soft Zoki Catalog aka Smart Catalog allows remote attackers to execute arbitrary SQL commands via the searchtext parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-2180

Multiple SQL injection vulnerabilities in cpLinks 1.03, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 adminusername parameter aka the username field to admin/index.php and the 2 searchtext and 3 searchcategory parameters to search.php. NOTE:...

CVE-2008-2181

Multiple cross-site scripting XSS vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 searchtext and 2 searchcategory parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtain...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 searchtext and 2 searchcategory parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtain...

CVE-2008-2180

Multiple SQL injection vulnerabilities in cpLinks 1.03, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 adminusername parameter aka the username field to admin/index.php and the 2 searchtext and 3 searchcategory parameters to search.php. NOTE:...

CVE-2008-2180: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in cpLinks 1.03, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 adminusername parameter aka the username field to admin/index.php and the 2 searchtext and 3 searchcategory parameters to search.php. NOTE:...

CVE-2008-2181: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 searchtext and 2 searchcategory parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some of these details are obtain...

CVE-2004-0304: Undefined Security Weakness

SQL injection vulnerability in browseitems.asp in WebCortex WebStores 2000 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the SearchText parameter...