CVE-2017-14509

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a...

supporters.yaf.org XSS vulnerability

Vulnerable URL: http://supporters.yaf.org/events/?filtercategory=supporter-eventssite=1'%22%26%25prompt/OPENBUGBOUNTY/...

Cross-site Scripting (XSS) Through URL Parameter

The Play Framework is vulnerable to cross-site scripting XSS. An XSS vulnerability has been found in Plays URL rendering. This vulnerability allows attackers to insert and execute arbitrary code...

CVE-2013-7429: XML Injection (aka Blind XPath Injection)

The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugingooglemap2proxy.php...

CVE-2015-2749

Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in the getfile function in upload/admin2/controller/reportlogs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the filepath parameter to upload/admin2...

Googlemaps Plugin Denial of Service Vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters development team developed a set of open source content management system CMS, it provides RSS feeds, site search and other features. Googlemaps is one of the set of Google Maps plug-ins. A security vulnerability exists in the Joomla! Googlemaps plugin that...

PT-2017-12336

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.7.4-3433 Synology Photo Station versions prior to 6.3-2968 Description A server-side request forgery SSRF issue exists in the file upload.php file, allowing remote authenticated users to download...

CVE-2017-12071: Server-Side Request Forgery (SSRF)

Server-side request forgery SSRF vulnerability in fileupload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter...

CVE-2013-7428: Uncontrolled Resource Consumption

The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugingooglemap2proxy.php...

Cross-site Scripting (XSS)

automattic/jetpack is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the URL parameter in sso.php...

Remote code execution

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...

CVE-2016-4462

CVE-2016-4462 concerns Apache OFBiz. A logged-in user can manipulate the externalLoginKey URL parameter to feed the Freemarker Template Engine with directives reflected on the page, enabling remote code execution via a specially crafted Freemarker template. Mitigation: upgrade to Apache OFBiz 16....

CVE-2016-4462

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...

GSA Bounty: Content injection via URL parameter.

Hello, The following URL is vulnerable to content & code injection. https://labs.data.gov/dashboard/validate...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2017-28224)

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in MantisBT versions prior to 1.2.19 and prior to 1.3.0-beta.2. A remote...

Cross site scripting

Cross-site scripting XSS vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php...

CVE-2014-9701

Cross-site scripting XSS vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php...

PT-2017-6390

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.19 MantisBT versions 1.3.x prior to 1.3.0-beta.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the url parameter to "permalink page.php"...

CVE-2014-9701: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php...