Personal Weather Station Dashboard 12 - Directory Traversal Detection

Personal Weather Station Dashboard 12lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/test.php, as demonstrated by reading the server's private SSL key in cleartext. !/usr/bin/env python3 -- coding: utf-8 -- """Person...

CVE-2026-31939

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $REQUEST'test' is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerabilit...

EUVD-2026-18408

A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. Affected is the function pingtest of the file /setup.cgi. Performing a manipulation of the argument c4IPAddr results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The...

OpenSky Flight Planning SQL Injection

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the gettest parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

EUVD-2002-1620

Malware in sbrugna...

CVE-2022-29728

Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting XSS vulnerability in the test parameter...

CVE-2018-10128

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

CVE-2025-47423: Path Traversal: '../filedir'

Personal Weather Station Dashboard 12lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/test.php, as demonstrated by reading the server's private SSL key in cleartext...

PT-2024-26872 · Engenius · Engenius Enstation5-Ac

Name of the Vulnerable Software and Affected Versions: EnGenius EnStation5-AC A8J-ENS500AC version 1.0.0 Description: The issue allows blind OS command injection via shell metacharacters in the Ping and Speed Test parameters. This can potentially be exploited to execute unauthorized commands on t...

Kashipara Music Management System security vulnerabilities

Kashipara Music Management System is a music management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Music Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the page parameter of...

be.zvz:kotlininside (>=1.14.0, <=1.14.6), com.google.protobuf:protobuf-kotlin-lite (>=3.20.0, <=3.20.2) +8 more potentially affected by CVE-2022-3509 via com.google.protobuf:protobuf-javalite (>=3.20.0, <=3.20.2)

com.google.protobuf:protobuf-javalite MAVEN version =3.20.0, =1.14.0, =3.20.0, =2.12.0, =2.12.0, =2.3.0, =0.2.4, =0.2.6 - io.github.dimensiondev:maskwalletcore 0.5.0 Source cves: CVE-2022-3509 Source advisory: OSV:GHSA-G5WW-5JH7-63CX...

CVE-2022-43051

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=deletetest...

CVE-2022-29728

Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting XSS vulnerability in the test parameter...

Cross site scripting

Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting XSS vulnerability in the test parameter...

CVE-2022-29728: Improper Neutralization of Input During Web Page Generation

Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting XSS vulnerability in the test parameter...

PT-2022-19801

Name of the Vulnerable Software and Affected Versions Survey Sparrow Enterprise Survey Software 2022 Description The issue is related to a Reflected cross-site scripting XSS vulnerability in the test parameter. This allows for potential malicious script injection and execution. Recommendations Fo...

CVE-2021-24778: Improper Neutralization of Special Elements used in an SQL Command

The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

PT-2022-9464

Name of the Vulnerable Software and Affected Versions Tradetracker-Store WordPress plugin versions prior to 4.6.60 Description The issue concerns the xmlfeed in the Tradetracker-Store WordPress plugin, where the test parameter is not properly sanitized, escaped, or validated before being inserted...

CVE-2021-31987

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients...

WordPress: SQL Injection Vulnerabilities

Wordpress Load More is Wordpress an open source application plugin . Provide a load more items function . WordPress Load More plugin before 5.3.2 SQL injection vulnerability exists , the vulnerability stems from /wp-admin/admin-ajax.php repeater parameter or type=test parameter...