Online Book System 跨站脚本漏洞

Online Book System is an online booking system. A cross-site scripting vulnerability exists in code-projects Online Book System version 1.0, which stems from a cross-site scripting vulnerability in the value parameter of the /Product.php file...

jose2go Security Vulnerabilities

jose2go is a Golang implementation of the Javascript object signing and encryption specification for individual developers at DV. A security vulnerability exists in jose2go versions prior to 1.6.0, which originated from a vulnerability that allows an attacker to cause a denial of service via a...

CVE-2023-51126

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 Jan 2023 the FLIR AX8 should no longer be affected by the...

CVE-2023-51126: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 Jan 2023 the FLIR AX8 should no longer be affected by the...

Teledyne FLIR AX8 Command Injection Vulnerability

Teledyne FLIR AX8 is a series of thermal surveillance cameras from Teledyne FLIR USA. The Teledyne FLIR AX8 suffers from a command injection vulnerability that stems from an arbitrary command execution vulnerability in the value parameter of the /usr/www/res.php page...

PT-2024-14053

Name of the Vulnerable Software and Affected Versions FLIR AX8 versions up to 1.46.16 Description A command injection issue exists in the /usr/www/res.php file, allowing attackers to execute arbitrary commands by manipulating the value parameter. Recommendations For FLIR AX8 versions up to 1.46.1...

CVE-2023-43705

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "translationvalue1" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

CVE-2023-40942

Tenda AC9 V3.0BRV15.03.06.42multiTD01 was discovered stack overflow via parameter 'firewallvalue' at url /goform/SetFirewallCfg...

CVE-2023-38767

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...

PT-2023-26595 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 5.0.0 Description: A SQL injection issue allows a remote attacker to obtain sensitive information via the value and custom parameters within the "/QueryView.php" API endpoint. Recommendations: For ChurchCRM version 5.0.0, as...

CVE-2023-38767: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...

The is no way for native tokens to get sent to InterchainProposalExecutor

Lines of code Vulnerability details Impact Proposals that require value cannot be executed as native tokens on the other side of the bridge cannot be provided. Proof of Concept Proposals have a value parameter, which allows users to specify what amount of native tokens should be passed when calli...

CVE-2023-28661: Improper Neutralization of Special Elements used in an SQL Command

The WP Popup Banners WordPress Plugin, version = 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the getpopupdata action...

PT-2023-9942 · Unknown · Php-Form-Builder-Class

Name of the Vulnerable Software and Affected Versions: manikandan170890 php-form-builder-class affected versions not specified Description: A vulnerability has been found in the Textarea Handler component of the php-form-builder-class, specifically in the file PFBC/Element/Textarea.php. The...

Sql injection

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'searchvalue parameter in the...

CVE-2022-43165: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the Global Variables feature /index.php?module=globalvars/vars of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking "Create"...

Rukovoditel 跨站脚本漏洞

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software features project management, customer relationship management, and more. A cross-site scripting vulnerability exists in Rukovoditel version 3.2.1, which stems from the Value parameter...

CVE-2022-35154

Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter...

CVE-2022-35154

Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter...

CVE-2022-35154

Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter...