Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,825

CVE-2017-20102

Album Lock getImage path traversal

A vulnerability was found in Album Lock 4.0 and classified as critical. Affected by this issue is some unknown functionality of the file /getImage. The manipulation of the argument filePaht leads to path traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Album Lock Project
Products
Album Lock
CVE-2017-20098

Admin Custom Login Plugin Persistent cross site scripting

A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Weblizar
Products
Admin Custom Login
CVE-2017-20103

Kama Click Counter Plugin admin.php Blind sql injection

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument order_by/order with the input ASC%2c(select*from(select(sleep(2)))a) leads to sql injection (Blind). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.9 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wp-kama
Products
Kama Click Counter
CVE-2017-20104

Simplessus Cookie Time sql injection

A vulnerability was found in Simplessus 3.7.7. It has been declared as critical. This vulnerability affects unknown code of the component Cookie Handler. The manipulation of the argument UWA_SID leads to sql injection (Time). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.8.3 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 7.3 High EPSS 1.1% KEV · Not listed
Vendors
Simplessus
Products
Simplessus
CVE-2017-20106

Lithium Forum Compose Message server-side request forgery

A vulnerability, which was classified as critical, has been found in Lithium Forum 2017 Q1. This issue affects some unknown processing of the component Compose Message Handler. The manipulation of the argument upload_url leads to server-side request forgery. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Khoros
Products
Lithium Forum
CVE-2017-20107

ShadeYouVPN.com Client privileges management

A vulnerability, which was classified as problematic, was found in ShadeYouVPN.com Client 2.0.1.11. Affected is an unknown function. The manipulation leads to improper privilege management. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1.12 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft Shadeyouvpn.com Project
Products
Windows Shadeyouvpn.com
CVE-2017-20108

Easy Table Plugin options-general.php cross site scripting

A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "><script>alert(1)</script> leads to basic cross site scripting. It is possible to initiate the attack remotely.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Easy Table Project
Products
Easy Table
CVE-2017-20109

Teleopti WFM Administration GetOneTenant Credentials information disclosure

A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /TeleoptiWFM/Administration/GetOneTenant of the component Administration. The manipulation leads to information disclosure (Credentials). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Calabrio
Products
Teleopti Workforce Management
CVE-2017-20110

Teleopti WFM Administration Credentials information disclosure

A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure (Credentials). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Calabrio
Products
Teleopti Workforce Management
CVE-2017-20112

IVPN Client privileges management

A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.6.2 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Ivpn
Products
Ivpn
CVE-2017-20113

TrueConf Server Stored cross site scripting

A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Trueconf
Products
Server
CVE-2017-20114

TrueConf Server Reflected cross site scripting

A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/get-all-status/. The manipulation of the argument keys[] leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Trueconf
Products
Server
CVE-2017-20115

TrueConf Server Reflected cross site scripting

A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /admin/conferences/list/. The manipulation of the argument sort leads to basic cross site scripting (Reflected). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Trueconf
Products
Server
CVE-2017-20116

TrueConf Server Reflected cross site scripting

A vulnerability was found in TrueConf Server 4.3.7. It has been classified as problematic. Affected is an unknown function of the file /admin/group/list/. The manipulation of the argument checked_group_id leads to basic cross site scripting (Reflected). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Trueconf
Products
Server
CVE-2017-20117

TrueConf Server group DOM cross site scripting

A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/group. The manipulation leads to basic cross site scripting (DOM). The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Trueconf
Products
Server
CVE-2017-20124

Online Hotel Booking System Pro Plugin roomtype-details.php sql injection

A vulnerability classified as critical has been found in Online Hotel Booking System Pro Plugin 1.0. Affected is an unknown function of the file /front/roomtype-details.php. The manipulation of the argument tid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bestsoftinc
Products
Online Hotel Booking System
CVE-2017-20125

Online Hotel Booking System Pro roomtype-details.php sql injection

A vulnerability classified as critical was found in Online Hotel Booking System Pro 1.2. Affected by this vulnerability is an unknown functionality of the file /roomtype-details.php. The manipulation of the argument tid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Bestsoftinc
Products
Online Hotel Booking System
CVE-2022-2262

Online Hotel Booking System Room edit_all_room.php sql injection

A vulnerability has been found in Online Hotel Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_all_room.php of the component Room Handler. The manipulation of the argument id with the input 2828%27%20AND%20(SELECT%203766%20FROM%20(SELECT(SLEEP(5)))BmIK)%20AND%20%27YLPl%27=%27YLPl leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Online Hotel Booking Project
Products
Online Hotel Booking
CVE-2022-2263

Online Hotel Booking System Room edit_room_cat.php sql injection

A vulnerability was found in Online Hotel Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file edit_room_cat.php of the component Room Handler. The manipulation of the argument roomname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Online Hotel Booking Project
Products
Online Hotel Booking