Search vulnerabilities

Expected end of text, found ',' (at char 24), (line:1, col:25)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2022-1526

Emlog Pro POST Parameter cross site scripting

A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiate the attack remotely but it requires a signup and login by the attacker. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Emlog
Products
Emlog
CVE-2022-1536

automad Dashboard cross site scripting

A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home</title><script>alert("home")</script><title> leads to a cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit details have disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Automad
Products
Automad
CVE-2022-1590

Bludit New Content Module new-content cross site scripting

A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content module. The manipulation of the argument content with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Bludit
Products
Bludit
CVE-2022-1753

WoWonder Group requests.php access control

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument group_id allows posting messages in other groups. It is possible to launch the attack remotely but it might require authentication. A video explaining the attack has been disclosed to the public.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wowonder
Products
Wowonder
CVE-2013-10001

HTC One/Sense Mail Client certificate validation

A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certification validation of the mail client. An exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Htc
Products
Mail One Sv One X and 2 more
CVE-2022-1817

Badminton Center Management System Userlist Module cross site scripting

A vulnerability, which was classified as problematic, was found in Badminton Center Management System. This affects the userlist module at /bcms/admin/?page=user/list. The manipulation of the argument username with the input </td><img src="" onerror="alert(1)"><td>1 leads to an authenticated cross site scripting. Exploit details have been disclosed to the public.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Badminton Center Management System Project
Products
Badminton Center Management System
CVE-2022-1819

Student Information System Student Roll Module cross site scripting

A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Affected is admin/?page=students of the Student Roll module. The manipulation with the input <script>alert(1)</script> leads to authenticated cross site scripting. Exploit details have been disclosed to the public.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Student Information System Project
Products
Student Information System
CVE-2022-1837

Home Clean Services Management System unrestricted upload

A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand. The manipulation with the input <?php phpinfo();?> leads to code execution. The attack may be launched remotely but demands an authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 4.7 Medium EPSS 1.3% KEV · Not listed
Vendors
Home Clean Services Management System Project
Products
Home Clean Services Management System
CVE-2022-1838

Home Clean Services Management System login.php sql injection

A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(5)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. It is possible to initiate the attack remotely but it requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 4.7 Medium EPSS 1.0% KEV · Not listed
Vendors
Home Clean Services Management System Project
Products
Home Clean Services Management System
CVE-2022-1839

Home Clean Services Management System login.php sql injection

A vulnerability classified as critical was found in Home Clean Services Management System 1.0. This vulnerability affects the file login.php. The manipulation of the argument email with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(2)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. The attack can be initiated remotely but it requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Home Clean Services Management System Project
Products
Home Clean Services Management System
CVE-2022-1840

Home Clean Services Management System cross site scripting

A vulnerability, which was classified as problematic, has been found in Home Clean Services Management System 1.0. This issue affects register.php?link=registerand. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but demands authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Home Clean Services Management System Project
Products
Home Clean Services Management System
CVE-2013-10002

Telecommunication Software SAMwin Contact Center Suite Credential SAMwinLIBVB.dll getCurrentDBVersion hard-coded credentials

A vulnerability was found in Telecommunication Software SAMwin Contact Center Suite 5.1. It has been rated as critical. Affected by this issue is the function getCurrentDBVersion in the library SAMwinLIBVB.dll of the credential handler. Authentication is possible with hard-coded credentials. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Telecomsoftware
Products
Samwin Agent Samwin Contact Center
CVE-2013-10003

Telecommunication Software SAMwin Contact Center Suite Database SAMwinLIBVB.dll getCurrentDBVersion sql injection

A vulnerability classified as critical has been found in Telecommunication Software SAMwin Contact Center Suite 5.1. This affects the function getCurrentDBVersion in the library SAMwinLIBVB.dll of the database handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Telecomsoftware
Products
Samwin Agent Samwin Contact Center
CVE-2021-4229

ua-parser-js Crypto Mining backdoor

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 5 Medium EPSS 1.5% KEV · Not listed
Vendors
Ua-parser-js Project
Products
Ua-parser-js
CVE-2021-4230

Airfield Online MySQL Backup improper authentication

A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An attacker is able to get access to sensitive data without proper authentication. It is recommended to the change the configuration settings.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Airfield Online Project
Products
Airfield Online
CVE-2021-4232

Zoo Management System manage-ticket.php cross site scripting

A vulnerability classified as problematic has been found in Zoo Management System 1.0. Affected is an unknown function of the file admin/manage-ticket.php. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. It is possible to launch the attack remotely.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Phpgurukul
Products
Zoo Management System
CVE-2022-1979

SourceCodester Product Show Room Site p=contact cross site scripting

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Product Show Room Site Project
Products
Product Show Room Site
CVE-2022-1980

SourceCodester Product Show Room Site cross site scripting

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/contact_info. The manipulation of the textbox Telephone with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Product Show Room Site Project
Products
Product Show Room Site
CVE-2022-1991

Fast Food Ordering System Master List Master.php cross site scripting

A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master List. The manipulation of the argument Description with the input foo "><img src="" onerror="alert(document.cookie)"> leads to cross site scripting. It is possible to launch the attack remotely but it requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Fast Food Ordering System Project
Products
Fast Food Ordering System
CVE-2022-23556

CodeIgniter is vulnerable to IP address spoofing when using proxy

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Codeigniter
Products
Codeigniter