Security
Headlines
HeadlinesLatestCVEs

Tag

#php

CVE-2022-44949: Stored Cross Site Scripting Vulnerability on "Fields Configuration" in "Short Name" field in rukovoditel 3.2.1 · Issue #12 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.

CVE
Open in Source
#xss#vulnerability#web#php#auth
CVE-2022-44948: Stored Cross Site Scripting Vulnerability on "Entities groups" in rukovoditel 3.2.1 · Issue #8 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".

CVE-2022-44947: Stored Cross Site Scripting Vulnerability on "Highlight row" in rukovoditel 3.2.1 · Issue #13 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking "Add".

CVE-2022-44946: Stored Cross Site Scripting Vulnerability on "Help system" in "Add page" function in rukovoditel 3.2.1 · Issue #15 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.

CVE-2022-44944: Stored Cross Site Scripting Vulnerability on "Help system" in "Add announcement" function in rukovoditel 3.2.1 · Issue #14 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.

CVE-2022-44348: bug_report/SQLi-3.md at main · BGP-OSPF/bug_report

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.

CVE-2022-44347: bug_report/SQLi-2.md at main · BGP-OSPF/bug_report

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=.

CVE-2022-44345: bug_report/SQLi-1.md at main · BGP-OSPF/bug_report

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=.

CVE-2022-44277: bug_report/SQLi-1.md at main · llwyx200113/bug_report

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.

CVE-2022-45215: Book Store Management System Project using PHP CodeIgniter 3 Free Source Code

A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the Add New System User module.