379 matches found
Sql injection
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
CVE-2020-25004
CVE-2020-25004 affects Heybbs v1.2. The vulnerability is a SQL injection in the user.php file via the ID parameter that may allow a remote attacker to execute arbitrary code. According to the connected documents, exploitation details are not provided in these sources, and CVSS metrics from NVD in...
CVE-2020-25004
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
Design/Logic Flaw
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
CVE-2020-15721
CVE-2020-15721 affects RosarioSIS up to 6.8-beta. A cross-site scripting (XSS) issue is caused by the href attributes in modules/Custom/NotifyParents.php affecting AddStudents.php and User.php. The connected documents do not provide a patch version, workaround, or explicit exploitation details. N...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
CVE-2020-13827
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...
Design/Logic Flaw
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...
CVE-2020-10410
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-user.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-user.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-user.php by adding a question mark ? followed by the payload...
CVE-2020-10451
CVE-2020-10451 affects Chadha PHPKB Standard MultiāLanguage 9. The issue is in URI handling in admin/header.php, enabling Reflected XSS in admin/report-user.php when a ? payload is appended; documentation also notes similar URI handling XSS patterns in related Red Hat advisories (e.g., add-articl...
CVE-2020-10410
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-user.php by adding a question mark ? followed by the payload...
CVE-2020-10399
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-user.php by adding a question mark ? followed by the payload...
CVE-2019-18195
TerraMaster FS-210 (firmware 4.0.19) contains an elevation-of-privilege flaw where normal users can leverage 1.user.php to gain higher privileges. Documented impact is network-accessible via the vulnerability with high severity (CVSS 3.1 base score 8.8, HIGH). Root cause details are not elaborate...
CVE-2019-12094
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...
CVE-2019-12094
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...
Hardcoded credentials
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...