20 matches found
CVE-2026-34107
Guardian language-system passes the id GET parameter directly into a PHP exec call in translate.php line 14 without sanitization: exec"php jobs/translate.php ".$loginsession." ".$GET'id'." ...". No authentication is required. An unauthenticated remote attacker can append shell metacharacters...
CVE-2026-34107 Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php
Guardian language-system passes the id GET parameter directly into a PHP exec call in translate.php line 14 without sanitization: exec"php jobs/translate.php ".$loginsession." ".$GET'id'." ...". No authentication is required. An unauthenticated remote attacker can append shell metacharacters...
CVE-2026-34107: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec call in translate.php line 14 without sanitization: exec"php jobs/translate.php ".$loginsession." ".$GET'id'." ...". No authentication is required. An unauthenticated remote attacker can append shell metacharacters...
CVE-2020-10455: Improper Neutralization of Input During Web Page Generation
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/translate.php by adding a question mark ? followed by the payload...
depinisyon.com XSS vulnerability
Open Bug Bounty ID: OBB-567930 Description| Value ---|--- Affected Website:| depinisyon.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
PHP Address Book Multiple Cross Site Scripting Vulnerabilities
This host is running PHP Address Book and is prone to multiple cross site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: secpodphpaddressbookmultxssvuln.nasl 5950 2017-04-13 09:02:06Z teissa $ PHP Address Book Multiple Cross Site Scripting Vulnerabilities Authors: Sooraj KS Copyright:...
CVE-2012-2903
Multiple cross-site scripting XSS vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to group.php, or the 2 targetlanguage or 3 targetflag parameter to translate.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to group.php, or the 2 targetlanguage or 3 targetflag parameter to translate.php...
CVE-2012-2903: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to group.php, or the 2 targetlanguage or 3 targetflag parameter to translate.php...
CVE-2011-5075
translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to obtain sensitive information via a direct request using the save action, which reveals the installation path...
CVE-2011-5075
translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to obtain sensitive information via a direct request using the save action, which reveals the installation path...
CVE-2011-4337
Static code injection vulnerability in translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable...
CVE-2011-5075
CVE-2011-5075 affects Support Incident Tracker SiT! versions 3.45–3.65. The flaw is an information-disclosure via translate.php (save action) that allows remote attackers to reveal the installation path. Connected sources corroborate an installation-path exposure; OpenVAS and RH advisories note b...
CVE-2011-5070
Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...
CVE-2011-4337: Improper Control of Generation of Code
Static code injection vulnerability in translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable...
CVE-2011-5070: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! 3.65 allow remote attackers to inject arbitrary web script or HTML via 1 the file name to incidentattachments.php; 2 unspecified vectors in linkadd.php, possibly involving origref, linkref, linktype parameters,...
CVE-2011-5075: Undefined Security Weakness
translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to obtain sensitive information via a direct request using the save action, which reveals the installation path...
Support Incident Tracker 3.65 - translate.php Remote Code Execution
Support Incident Tracker 3.65 - translate.php Remote Code Execution ?php / ------------------------------------------------------------------------------ Support Incident Tracker = 3.65 translate.php Remote Code Execution Exploit...
CVE-2005-3403: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to inject arbitrary web script or HTML via 1 the basehref parameter in translate.php, 2 the basepath parameter in news.inc.php, and 3 the p parameter in addnote.php...