146 matches found
PT-2022-22604 · Unknown · Shopro Mall System
Name of the Vulnerable Software and Affected Versions: Shopro Mall System version 1.3.8 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the value parameter. Recommendations: For Shopro Mall System version 1.3.8, consider restricting acce...
Shopro Mall System SQL注入漏洞
XPTECH Shopro Mall System is a mall management system from China's XPTECH company. A security vulnerability exists in Shopro Mall System v1.3.8, which originates from the discovery of a SQL injection vulnerability via the value parameter...
CVE-2022-35154: Improper Neutralization of Special Elements used in an SQL Command
Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter...
The vulnerability of the WWebView component of MCE Systems’ mobile device lifecycle management system allows a hacker to execute arbitrary commands.
The vulnerability of MCE Systems’ WWebView component in mobile device lifecycle management systems lies in the lack of measures taken to neutralize special elements used by the operating system when processing the value parameter. Exploiting this vulnerability allows an attacker to execute...
CVE-2021-28290
A cross-site scripting XSS vulnerability in Skoruba IdentityServer4.Admin before 2.0.0 via unencoded value passed to the data-secret-value parameter...
Genesys Intelligent Workload Distribution SQL注入漏洞
Genesys Intelligent Workload Distribution Iwd is an application from Genesys, Inc. It can be used with the Genesys Customer Interaction Management Cim platform to assign tasks to the resources best suited to handle them. A SQL injection vulnerability exists in Genesys Intelligent Workload...
CVE-2021-39412
Multiple Cross Site Scripting XSS vulnerabilities exists in PHPGurukul Shopping v3.1 via the 1 callback parameter in a serverside/scripts/idjsonp.php, b serverside/scripts/jsonp.php, and c scripts/objectsjsonp.php, the 2 value parameter in examplessupport/editableajax.php, and the 3 PHPSELF...
CVE-2021-39412
Multiple Cross Site Scripting XSS vulnerabilities exists in PHPGurukul Shopping v3.1 via the 1 callback parameter in a serverside/scripts/idjsonp.php, b serverside/scripts/jsonp.php, and c scripts/objectsjsonp.php, the 2 value parameter in examplessupport/editableajax.php, and the 3 PHPSELF...
CVE-2020-8288
The specializedRendering function in Rocket.Chat server before 3.9.2 allows a cross-site scripting XSS vulnerability by way of the value parameter...
CVE-2020-8288
The specializedRendering function in Rocket.Chat server before 3.9.2 allows a cross-site scripting XSS vulnerability by way of the value parameter...
Rocket.Chat server 跨站脚本漏洞
Rocket.Chat is an open source team chat software. A cross-site scripting vulnerability exists in Rocket.Chat server versions prior to 3.9.2, which stems from the value parameter. No details of the vulnerability are available at this time...
CVE-2020-8288: Improper Neutralization of Input During Web Page Generation
The specializedRendering function in Rocket.Chat server before 3.9.2 allows a cross-site scripting XSS vulnerability by way of the value parameter...
Design/Logic Flaw
Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter...
CVE-2019-7356
Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter...
KoreaShow Number Error Vulnerability
KoreaShow is a system for cryptocurrency trading. An integer overflow vulnerability exists in the 'transferMulti' function in the smart contract implementation of KoreaShow. The vulnerability can be exploited by an attacker to increase digital assets with the help of the 'value' parameter...
Electronic Logbook (ELOG) Cross-Site Scripting Vulnerability (CNVD-2020-14077)
ELOG is a web application written in C by Stefan Ritt that can be used to create personal and frequently used logs. A cross-site scripting vulnerability exists in Electronic Logbook ELOG 3.1.4. A remote attacker can exploit this vulnerability by injecting arbitrary web script or HTML into elogd.c...
CVE-2019-20375: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in Electronic Logbook ELOG 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization loc command to elogd.c...
CVE-2019-14343
TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabularioid=list URI...
CVE-2019-14343
CVE-2019-14343 affects TemaTres 3.0, with a stored XSS vulnerability in the parameter value of the vocab/admin.php?vocabulario_id=list endpoint. Multiple connected records confirm the vulnerability and describe client-side code execution potential. The root cause is a stored XSS flaw in the value...