External Control of Assumed-Immutable Web Parameter

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter due to missing sanitization of the return URL requested by the client. This allows an attacker to introduce arbitrary values to a known loc...

CVE-2025-47245: External Control of Assumed-Immutable Web Parameter

In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role...

CVE-2023-52066

http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter...

D-Link DIR-605L Router Code Execution

The vulnerability of the formWlanSetupWizard function /goform/formWlanSetupWizard in D-Link DIR-605L router software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using the webpage parameter...

CVE-2024-9532

A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The...

PLANET switch devices: Cross-site scripting vulnerabilities

PLANET switch devices are a series of switch devices from the Chinese company PLANET. A cross-site scripting vulnerability exists in PLANET switch devices, which stems from improper validation of web application parameters and is susceptible to stored cross-site scripting attacks...

Yunke Online School System: Path traversal vulnerability

Yunke Online School System is an online school software from the Chinese company Yunke. A path traversal vulnerability exists in Yunke Online School System 3.0.6 and earlier versions, which stems from a path traversal caused by the parameter url of the file application/admin/controller/Appadmin.p...

CVE-2024-7941

An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials...

PT-2024-38706 · Hitachi Energy · Microscada X Sys600

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows an HTTP parameter to contain a URL value, which can cause the web application to redirect the request to the specified URL. An attacker...

CVE-2024-20400

A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this...

CVE-2023-38520: External Control of Assumed-Immutable Web Parameter

External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4...

PT-2024-12734

Name of the Vulnerable Software and Affected Versions Pinpoint Booking System versions 2.9.9.3.4 and earlier Description The issue affects the Pinpoint Booking System, allowing for functionality misuse due to an External Control of Assumed-Immutable Web Parameter vulnerability. Recommendations Fo...

CVE-2023-24373

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3...

CVE-2023-24373 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3...

CVE-2023-24373 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3...

CVE-2023-24373: External Control of Assumed-Immutable Web Parameter

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3...

PT-2024-12030

Name of the Vulnerable Software and Affected Versions WpDevArt Booking calendar, Appointment Booking System versions 3.2.3 and earlier Description The issue affects the WpDevArt Booking calendar, Appointment Booking System, allowing manipulation of hidden fields due to an External Control of...

D-Link DIR-619L Router DoS

The vulnerability of the formWlanSetupwizard function in the D-Link DIR-619L router’s microprogramming system is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by using the webpage...

PT-2024-33009 · Campcodes · Campcodes Online Laundry Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Laundry Management System version 1.0 Description: A critical issue has been found in the HTTP Request Parameter Handler component of the system, specifically affecting the manage user.php file. The manipulation of the id...

Fedora 40 : rubygem-httparty (2024-a1ce4ef332)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a1ce4ef332 advisory. Automatic update for rubygem-httparty-0.21.0-1.fc40. Changelog Fri Jan 5 2024 Vt Ondruch - 0.21.0-1 - Update to HTTParty 0.20.0. Resolves: rhbz17016...