447 matches found
CVE-2017-17959: Improper Neutralization of Special Elements used in an SQL Command
PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter...
CVE-2017-17954: Improper Neutralization of Input During Web Page Generation
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter...
brovary.info XSS vulnerability
Vulnerable URL: http://www.brovary.info/catalog/view.php?id=3758=2"'--!...
Sql injection
SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php...
CVE-2017-14345
CVE-2017-14345 affects the tianchoy/blog project, where a SQL injection is possible through the id parameter to view.php. The vulnerability is described across multiple sources (Red Hat, CNVD, NVD, CVE listings) as existing up to 2017-09-12, with the attack surface being the id parameter passed t...
CVE-2017-14345: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php...
blossomtouch.com XSS vulnerability
Vulnerable URL: https://blossomtouch.com/catalog/view/theme/quick-view.php?productid=740href=xss%22%3E%3Csvg/onload=prompt/openbugbounty/%3E%3C!-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 07.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclose...
Dzzoffice v1.3.1 Arbitrary File Download Vulnerability in Multiple Pages
DzzOffice is an open source cloud storage management tool. Dzzoffice v1.3.1 Arbitrary file download vulnerability exists in the 'pdfviewer.php', 'view.php', 'download.php' and 'attachment.php' pages, which can be exploited by attackers to obtain sensitive information...
bjbevanston.com XSS vulnerability
Vulnerable URL: http://www.bjbevanston.com/view.php?last-tab=1/-///'/"//--...
kenwatches.com XSS vulnerability
Vulnerable URL: http://www.kenwatches.com/view.php?k=Rolex=0=3〈=1/-///'/"//--...
artvault.co.za XSS vulnerability
Vulnerable URL: http://www.artvault.co.za/view.php?id=20772=artistid=1="';-- =artists.sname=0=270 Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 19:26 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5563836 V...
semcms /semcms/view.php parameter ID injection vulnerability
No description provided by source...
CVE-2017-6537: Improper Neutralization of Input During Web Page Generation
A Cross-Site Scripting XSS issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data bgcolor passed to the webpagetest-master/www/video/view.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context o...
CVE-2017-6533: Improper Neutralization of Input During Web Page Generation
A Cross-Site Scripting XSS issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data benchmark passed to the webpagetest-master/www/benchmarks/view.php URL. An attacker could execute arbitrary HTML and script code in a browser in the...
FreePBX 13/14 - Remote Command Execution / Privilege Escalation
!/usr/bin/env python -- coding, latin-1 -- DESCRIPTION FreePBX 13 remote root 0day - Found and exploited by pgt @ nullsecurity.net AUTHOR pgt - nullsecurity.net DATE 8-12-2016 VERSION freepbx0day.py 0.1 AFFECTED VERSIONS FreePBX 13 & 14 System Recordings Module versions: 13.0.1beta1 - 13.0.26...
FreePBX 13 / 14 - Remote Command Execution / Privilege Escalation
Exploit for linux platform in category remote exploits !/usr/bin/env python -- coding, latin-1 -- DESCRIPTION FreePBX 13 remote root 0day - Found and exploited by pgt @ nullsecurity.net AUTHOR pgt - nullsecurity.net DATE 8-12-2016 VERSION freepbx0day.py 0.1 AFFECTED VERSIONS FreePBX 13 & 14 Syste...
CANDID 'view.php' SQL Injection and Cross Site Scripting Vulnerabilities
CANDID is prone to sql injection and cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
benettonkorea.co.kr XSS vulnerability
Vulnerable URL: http://www.benettonkorea.co.kr/shop5/shop/board/view.php?no=...
CVE-2015-5338: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to 1 mod/lesson/mediafile.php or 2...