Search vulnerabilities

Expected end of text, found ',' (at char 24), (line:1, col:25)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2022-1075

College Website Management System Contact cross site scripting

A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f=save_contact of the component Contact Handler. The manipulation leads to persistent cross site scripting. The attack may be launched remotely and requires authentication.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
College Website Management System Project
Products
College Website Management System
CVE-2022-1076

Automatic Question Paper Generator System My Account Page login.php cross site scripting

A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aqpg/users/login.php of the component My Account Page. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Automatic Question Paper Generator System Project
Products
Automatic Question Paper Generator System
CVE-2025-3036

yzk2356911358 StudentServlet-JSP Student Management cross site scripting

A vulnerability, which was classified as problematic, was found in yzk2356911358 StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a4831206f2714b21820f991. This affects an unknown part of the component Student Management Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Yzk2356911358
Products
Studentservlet-jsp
CVE-2022-1077

TEM FLEX-1080/FLEX-1085 Log information disclosure

A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated remotely and does not require any form of authentication.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Tem
Products
Flex-1080 Flex-1080 Firmware Flex-1085 and 1 more
CVE-2022-1078

SourceCodester College Website Management System sql injection

A vulnerability was found in SourceCodester College Website Management System 1.0. It has been classified as critical. Affected is the file /cwms/admin/?page=articles/view_article/. The manipulation of the argument id with the input ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc with an unknown input leads to sql injection. It is possible to launch the attack remotely and without authentication.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
College Website Management System Project
Products
College Website Management System
CVE-2022-1079

SourceCodester One Church Management System churchprofile.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester One Church Management System. Affected are multiple files and parameters which are prone to to cross site scripting. It is possible to launch the attack remotely.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
One Church Management System Project
Products
One Church Management System
CVE-2022-1080

SourceCodester One Church Management System attendancy.php sql injection

A vulnerability was found in SourceCodester One Church Management System 1.0. It has been declared as critical. This vulnerability affects code of the file attendancy.php as the manipulation of the argument search2 leads to sql injection. The attack can be initiated remotely.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
One Church Management System Project
Products
One Church Management System
CVE-2022-1081

SourceCodester Microfinance Management System addcustomerHandler.php cross site scripting

A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been declared as problematic. This vulnerability affects the file /mims/app/addcustomerHandler.php. The manipulation of the argument first_name, middle_name, and surname leads to cross site scripting. The attack can be initiated remotely.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microfinance Management System Project
Products
Microfinance Management System
CVE-2022-1082

SourceCodester Microfinance Management System Login Page login.php sql injection

A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been rated as critical. This issue affects the file /mims/login.php of the Login Page. The manipulation of the argument username/password with the input '||1=1# leads to sql injection. The attack may be initiated remotely.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microfinance Management System Project
Products
Microfinance Management System
CVE-2022-1083

Microfinance Management System sql injection

A vulnerability classified as critical has been found in Microfinance Management System. The manipulation of arguments like customer_type_number/account_number/account_status_number/account_type_number with the input ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc leads to sql injection in multiple files. It is possible to launch the attack remotely.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microfinance Management System Project
Products
Microfinance Management System
CVE-2022-1084

SourceCodester One Church Management System Session userregister.php improper authentication

A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /one_church/userregister.php. The manipulation leads to authentication bypass. The attack can be launched remotely.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
One Church Management System Project
Products
One Church Management System
CVE-2022-1085

CLTPHP POST Parameter cross site scripting

A vulnerability was found in CLTPHP up to 6.0. It has been declared as problematic. Affected by this vulnerability is the POST Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Cltphp
Products
Cltphp
CVE-2022-1087

htmly Edit Profile Module cross site scripting

A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipulation of the field Title with script tags leads to persistent cross site scripting. The attack may be initiated remotely and requires an authentication. A simple POC has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Htmly
Products
Htmly
CVE-2022-1210

LibTIFF tiff2ps resource consumption

A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Libtiff Netapp
Products
Libtiff Ontap Select Deploy Administration Utility
CVE-2022-1211

tildearrow Furnace FUR to VGM Converter stack-based overflow

A vulnerability classified as critical has been found in tildearrow Furnace dev73. This affects the FUR to VGM converter in console mode which causes stack-based overflows and crashes. It is possible to initiate the attack remotely but it requires user-interaction. A POC has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tildearrow
Products
Furnace
CVE-2022-1248

SAP Information System POST Request add_admin.php improper authentication

A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controllers/add_admin.php. An unauthenticated attacker is able to create a new admin account for the web application with a simple POST request. Exploit details were disclosed.

CVSS 3.1 · 7.3 High EPSS 1.4% KEV · Not listed
Vendors
Sap Information System Project
Products
Sap Information System
CVE-2022-1288

School Club Application System cross site scripting

A vulnerability, which was classified as problematic, has been found in School Club Application System 1.0. This issue affects access to /scas/admin/. The manipulation of the parameter page with the input %22%3E%3Cimg%20src=x%20onerror=alert(1)%3E leads to a reflected cross site scripting. The attack may be initiated remotely and does not require any form of authentication. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
School Club Application System Project
Products
School Club Application System
CVE-2022-1289

tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of service

A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. The issue got fixed with the patch 0eb02422d5161767e9983bdaa5c429762d3477ce.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Tildearrow
Products
Furnace
CVE-2022-1350

GhostPCL gsmchunk.c chunk_free_object memory corruption

A vulnerability classified as problematic was found in GhostPCL 9.55.0. This vulnerability affects the function chunk_free_object of the file gsmchunk.c. The manipulation with a malicious file leads to a memory corruption. The attack can be initiated remotely but requires user interaction. The exploit has been disclosed to the public as a POC and may be used. It is recommended to apply the patches to fix this issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostpcl
CVE-2022-1503

GetSimple CMS Content Module edit.php cross site scripting

A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like <script>alert(1)</script> leads to cross site scripting. The attack may be launched remotely but requires authentication. Expoit details have been disclosed within the advisory.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Get-simple
Products
Getsimple Cms