CVE-2022-2363

SourceCodester Simple Parking Management System cross site scripting

A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by this issue is some unknown functionality of the file /ci_spms/admin/search/searching/. The manipulation of the argument search with the input "><script>alert("XSS")</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Simple Parking Management System Project

Products

Simple Parking Management System

CVE-2022-2364

SourceCodester Simple Parking Management System category cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Simple Parking Management System 1.0. This affects an unknown part of the file /ci_spms/admin/category. The manipulation of the argument vehicle_type with the input "><script>alert("XSS")</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Simple Parking Management System Project

Products

Simple Parking Management System

CVE-2017-20129

LogoStore search.php sql injection

A vulnerability was found in LogoStore. It has been classified as critical. Affected is an unknown function of the file /LogoStore/search.php. The manipulation of the argument query with the input test' UNION ALL SELECT CONCAT(CONCAT('qqkkq','VnPVWVaYxljWqGpLLbEIyPIHBjjjjASQTnaqfKaV'),'qvvpq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- oCrh&search= leads to sql injection. It is possible to launch the attack remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Logostore Project

Products

Logostore

CVE-2022-2396

SourceCodester Simple e-Learning System claire_blake cross site scripting

A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claire_blake. The manipulation of the argument Bio with the input "><script>alert(document.cookie)</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Simple E-learning System Project

Products

Simple E-learning System

CVE-2022-2418

URVE Web Manager img_upload.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 8 High EPSS 1.1% KEV · Not listed

Vendors

Eveo

Products

Urve Web Manager

CVE-2022-2419

URVE Web Manager upload.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 8 High EPSS 12.8% KEV · Not listed

Vendors

Eveo

Products

Urve Web Manager

CVE-2022-2420

URVE Web Manager uploader.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 8 High EPSS 1.1% KEV · Not listed

Vendors

Eveo

Products

Urve Web Manager

CVE-2017-20130

Itech Real Estate Script search_property.php sql injection

A vulnerability was found in Itech Real Estate Script 3.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /real-estate-script/search_property.php. The manipulation of the argument property_for leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Itechscripts

Products

Real Estate Script

CVE-2017-20131

Itech News Portal information.php sql injection

A vulnerability was found in Itech News Portal 6.28. It has been classified as critical. Affected is an unknown function of the file /news-portal-script/information.php. The manipulation of the argument inf leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Itechscripts

Products

News Portal Script

CVE-2017-20132

Itech Multi Vendor Script product-list.php sql injection

A vulnerability was found in Itech Multi Vendor Script 6.49 and classified as critical. This issue affects some unknown processing of the file /multi-vendor-shopping-script/product-list.php. The manipulation of the argument pl leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Multi Vendor Script

CVE-2017-20134

Itech Freelancer Script category.php sql injection

A vulnerability, which was classified as critical, has been found in Itech Freelancer Script 5.13. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument sk leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Freelancer Script

CVE-2017-20135

Itech Dating Script see_more_details.php sql injection

A vulnerability classified as critical was found in Itech Dating Script 3.26. Affected by this vulnerability is an unknown functionality of the file /see_more_details.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Dating Script

CVE-2017-20136

Itech Classifieds Script subpage.php sql injection

A vulnerability classified as critical has been found in Itech Classifieds Script 7.27. Affected is an unknown function of the file /subpage.php. The manipulation of the argument scat with the input =51' AND 4941=4941 AND 'hoCP'='hoCP leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Classifieds Script

CVE-2017-20137

Itech B2B Script catcompany.php sql injection

A vulnerability was found in Itech B2B Script 4.28. It has been rated as critical. This issue affects some unknown processing of the file /catcompany.php. The manipulation of the argument token with the input 704667c6a1e7ce56d3d6fa748ab6d9af3fd7' AND 6539=6539 AND 'Fakj'='Fakj leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

B2b Script

CVE-2017-20138

Itech Auction Script mcategory.php Blind sql injection

A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 AND 'Ggks'='Ggks leads to sql injection (Blind). It is possible to initiate the attack remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Auction Script

CVE-2015-10003

FileZilla Server PORT confused deputy

A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Filezilla-project

Products

Filezilla Server

CVE-2016-15003

FileZilla Client Installer uninstall.exe unquoted search path

A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Filezilla-project Microsoft

Products

Filezilla Client Windows

CVE-2022-2468

SourceCodester Garage Management System editbrand.php sql injection

A vulnerability was found in SourceCodester Garage Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /editbrand.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Garage Management System Project

Products

Garage Management System

CVE-2022-2486

WAVLINK WN535K2/WN535K3 os command injection

A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 8 High EPSS 30.2% KEV · Not listed

Vendors

Wavlink

Products

Wl-wn535k2 Wl-wn535k2 Firmware Wl-wn535k3 and 1 more

CVE-2022-2487

WAVLINK WN535K2/WN535K3 nightled.cgi os command injection

A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 8 High EPSS 79.3% KEV · Not listed

Vendors

Wavlink

Products

Wl-wn535k2 Wl-wn535k2 Firmware Wl-wn535k3 and 1 more