Cross site scripting

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-24876: Improper Neutralization of Input During Web Page Generation

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the...

Design/Logic Flaw

In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...

PT-2019-19280

Name of the Vulnerable Software and Affected Versions Indexhibit version 2.1.5 Description The issue allows remote attackers to execute arbitrary code. This can be achieved by exploiting the v parameter in conjunction with the id parameter when a upd jxcode=true action is sent to the...

CVE-2019-8954: Improper Input Validation

In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...

CVE-2018-17832

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-17832

WUZHICMS 2.0 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the v and f GET parameters. The issue is described as XSS in the WUZHICMS 2.0 web application, with PoC references showing injected content via index.php?v= and index.php?f=. No explicit root-caus...

PT-2018-14212

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 2.0 Description A security issue exists due to the presence of XSS in the software. The issue is related to the v or f parameter in the "index.php" endpoint. Recommendations For WUZHI CMS version 2.0, consider restricting...

CVE-2018-17832: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

PT-2016-5624

Name of the Vulnerable Software and Affected Versions LibTIFF versions 4.0.6 and earlier Description The issue allows remote attackers to cause a denial of service by setting certain parameters to 0. Specifically, this can be done by setting the v or h parameter to 0 in the rgb2ycbcr tool...

CVE-2014-4601

Cross-site scripting XSS vulnerability in wu-ratepost.php in the Wu-Rating plugin 1.0 12319 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the v parameter...

PT-2014-6014

Name of the Vulnerable Software and Affected Versions Wu-Rating plugin versions 1.0 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the v parameter in the wu-ratepost.php file...

CVE-2014-4601: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wu-ratepost.php in the Wu-Rating plugin 1.0 12319 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the v parameter...

PT-2012-4365

Name of the Vulnerable Software and Affected Versions Chevereto version 1.9.1 Description A directory traversal issue exists, allowing remote attackers to determine the existence of arbitrary files by using a .. dot dot in the v parameter of the Upload/engine.php file. Recommendations For Chevere...

CVE-2012-2918: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HTML via the v parameter...

PT-2012-4364

Name of the Vulnerable Software and Affected Versions Chevereto version 1.91 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the v parameter in the Upload/engine.php file. Recommendations For Chevereto...

CVE-2010-0803: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the jVideoDirect comjvideodirect component 1.1 RC3b for Joomla! allows remote attackers to execute arbitrary SQL commands via the v parameter to index.php...

CVE-2009-4432: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in CodeMight VideoCMS 3.1 allows remote attackers to execute arbitrary SQL commands via the v parameter in a video action...

CVE-2009-3665: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to execute arbitrary SQL commands via the 1 i parameter or 2 v parameters in a register action...