673 matches found
Sql injection
Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter...
CVE-2022-25398
Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter...
CVE-2022-25398: Improper Neutralization of Special Elements used in an SQL Command
Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter...
CVE-2022-24582
Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manageuser from User lists is vulnerable to XSS-Stored and PHPSESSID attacks. The malicious user can attack the system by using the already session which he has from inside and outside of the network...
Cross-site Scripting (XSS) - Generic
Description The user-controlled GET user parameter in index.php is unsanitized resulting in Cross-Site Scripting. Proof of Concept Endpoint: GET https://HOST/edit/user File: /web/edit/user/index.phpL11 // Check user argument if empty$GET'user' header"Location: /list/user/"; exit; Request...
Online Payment Hub SQL注入漏洞
Online Payment Hub is an online payment hub for Carlo Montero personal developers. The Online Payment Hub is vulnerable to SQL injection due to a lack of filtering and escaping of SQL data in Login.php, which could be exploited to execute arbitrary SQL commands via the username parameter...
GOautodial 路径遍历漏洞
GOautodial is a next-generation open source omnichannel contact center suite. GOautodial suffers from a security vulnerability that stems from the software taking a user-supplied action parameter and attaching a php file extension to locate and load the correct PHP file, but not filtering and...
CVE-2017-20008 myCRED < 1.7.8 - Reflected Cross-Site Scripting
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting...
CVE-2017-20008: Improper Neutralization of Input During Web Page Generation
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting...
CVE-2021-31852
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...
PT-2021-23457 · Unknown · Resourcespace
Name of the Vulnerable Software and Affected Versions: ResourceSpace versions prior to 9.6 rev 18290 Description: The issue allows for malicious JavaScript content to be executed within the context of a victim's browser, due to a reflected Cross-Site Scripting vulnerability. This can occur when a...
Design/Logic Flaw
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients...
Laundry Booking Management System 1.0 - 'Multiple' SQL Injection
Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' SQL Injection Date: 2021-08-19 Exploit Author: Azumah Foresight Xorlali Vendor Homepage: https://www.sourcecodester.com/php/14400/laundry-booking-management-system-php-source-code.html Software Link:...
Cross site scripting
UNSUPPORTED WHEN ASSIGNED LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2021-38157
LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2021-38157
LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
Leostream Connection Broker 跨站脚本漏洞
Leostream Connection Broker is a vendor-neutral connection broker from Leostream, Inc. that provides a single interface to manage a range of operating systems, physical and virtual desktops, and display protocols that are common in enterprise environments. A cross-site scripting vulnerability...
CVE-2021-38157: Improper Neutralization of Input During Web Page Generation
LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
PT-2021-21974 · Unknown · Leostream Connection Broker
Name of the Vulnerable Software and Affected Versions: LeoStream Connection Broker versions 9.x before 9.0.34.3 Description: The issue allows Unauthenticated Reflected XSS via the "/index.pl" API endpoint, specifically through the user parameter. This affects products that are no longer supported...
