Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

CVE-2022-1837

Home Clean Services Management System unrestricted upload

A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand. The manipulation with the input <?php phpinfo();?> leads to code execution. The attack may be launched remotely but demands an authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 4.7 Medium EPSS 1.3% KEV · Not listed
Vendors
Home Clean Services Management System Project
Products
Home Clean Services Management System
CVE-2022-1838

Home Clean Services Management System login.php sql injection

A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(5)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. It is possible to initiate the attack remotely but it requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 4.7 Medium EPSS 1.0% KEV · Not listed
Vendors
Home Clean Services Management System Project
Products
Home Clean Services Management System
CVE-2022-1839

Home Clean Services Management System login.php sql injection

A vulnerability classified as critical was found in Home Clean Services Management System 1.0. This vulnerability affects the file login.php. The manipulation of the argument email with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(2)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. The attack can be initiated remotely but it requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Home Clean Services Management System Project
Products
Home Clean Services Management System
CVE-2022-1840

Home Clean Services Management System cross site scripting

A vulnerability, which was classified as problematic, has been found in Home Clean Services Management System 1.0. This issue affects register.php?link=registerand. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but demands authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Home Clean Services Management System Project
Products
Home Clean Services Management System
CVE-2013-10002

Telecommunication Software SAMwin Contact Center Suite Credential SAMwinLIBVB.dll getCurrentDBVersion hard-coded credentials

A vulnerability was found in Telecommunication Software SAMwin Contact Center Suite 5.1. It has been rated as critical. Affected by this issue is the function getCurrentDBVersion in the library SAMwinLIBVB.dll of the credential handler. Authentication is possible with hard-coded credentials. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Telecomsoftware
Products
Samwin Agent Samwin Contact Center
CVE-2013-10003

Telecommunication Software SAMwin Contact Center Suite Database SAMwinLIBVB.dll getCurrentDBVersion sql injection

A vulnerability classified as critical has been found in Telecommunication Software SAMwin Contact Center Suite 5.1. This affects the function getCurrentDBVersion in the library SAMwinLIBVB.dll of the database handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Telecomsoftware
Products
Samwin Agent Samwin Contact Center
CVE-2021-4229

ua-parser-js Crypto Mining backdoor

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 5 Medium EPSS 1.5% KEV · Not listed
Vendors
Ua-parser-js Project
Products
Ua-parser-js
CVE-2021-4230

Airfield Online MySQL Backup improper authentication

A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An attacker is able to get access to sensitive data without proper authentication. It is recommended to the change the configuration settings.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Airfield Online Project
Products
Airfield Online
CVE-2021-4232

Zoo Management System manage-ticket.php cross site scripting

A vulnerability classified as problematic has been found in Zoo Management System 1.0. Affected is an unknown function of the file admin/manage-ticket.php. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. It is possible to launch the attack remotely.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Phpgurukul
Products
Zoo Management System
CVE-2022-1979

SourceCodester Product Show Room Site p=contact cross site scripting

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Product Show Room Site Project
Products
Product Show Room Site
CVE-2022-1980

SourceCodester Product Show Room Site cross site scripting

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/contact_info. The manipulation of the textbox Telephone with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Product Show Room Site Project
Products
Product Show Room Site
CVE-2022-1991

Fast Food Ordering System Master List Master.php cross site scripting

A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master List. The manipulation of the argument Description with the input foo "><img src="" onerror="alert(document.cookie)"> leads to cross site scripting. It is possible to launch the attack remotely but it requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Fast Food Ordering System Project
Products
Fast Food Ordering System
CVE-2022-23556

CodeIgniter is vulnerable to IP address spoofing when using proxy

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Codeigniter
Products
Codeigniter
CVE-2020-36527

Server Status HTTP Status/SMTP Status cross site scripting

A vulnerability, which was classified as problematic, has been found in Server Status. This issue affects some unknown processing of the component HTTP Status/SMTP Status. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Aptis-solutions
Products
Server Status
CVE-2020-36528

Platinum Mobile MobileHandler.ashx access control

A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control. The attack requires authentication. Upgrading to version 1.0.4.851 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Platinumchina
Products
Platinum Mobile
CVE-2020-36529

SevOne Network Management System Traceroute traceroute.php command injection

A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Traceroute Handler. The manipulation leads to privilege escalation with a command injection. It is possible to initiate the attack remotely.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Ibm
Products
Sevone Network Performance Management
CVE-2020-36530

SevOne Network Management System Alert Summary sql injection

A vulnerability classified as critical was found in SevOne Network Management System up to 5.7.2.22. This vulnerability affects the Alert Summary. The manipulation leads to sql injection. The attack can be initiated remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Sevone Network Performance Management
CVE-2020-36531

SevOne Network Management System Device Manager Page injection

A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Sevone Network Performance Management
CVE-2020-36533

Klapp App JSON Web Token improper authentication

A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely.

CVSS 3.1 · 3.7 Low EPSS 1.5% KEV · Not listed
Vendors
Klapp
Products
App
CVE-2020-36534

easyii CMS out cross-site request forgery

A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Easyiicms
Products
Easyiicms