Security
Headlines
HeadlinesLatestCVEs

Tag

#php

CVE-2022-45536: CVE/post_comments_sql_injection.md at master · rdyx0/CVE

AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \admin\post_comments.php. This vulnerability allows attackers to access database information.

CVE
Open in Source
#sql#vulnerability#web#windows#apple#php#chrome#webkit
CVE-2022-43212: Billing System Project in PHP Source Code Free Download

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php.

CVE-2022-41445: GitHub - RashidKhanPathan/CVE-2022-41445: Cross Site Scripting in Teacher's Record Management System using CodeIgnitor

A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Subject page.

CVE-2022-42098: Release Development Release · msaad1999/KLiK-SocialMediaWebsite

KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php.

CVE-2022-43215: CVE/CVE-2022-43215(sql in getOrderReport.php).md at main · Qrayyy/CVE

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php.

CVE-2022-43214: CVE/CVE-2022-43214(sql in printOrder.php).md at main · Qrayyy/CVE

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php.

CVE-2022-36180: FusionDirectory.com is for sale | HugeDomains

Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection], /fusiondirectory/index.php?signout=1&message=[injection]&plug=106.

CVE-2022-30529: GitHub - killmonday/isic.lk-RCE: isic.lk tour booking website multi vuln (sqli/ file upload / info leak) lead to RCE

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php.

CVE-2022-40842: cve-s/poc.txt at main · daaaalllii/cve-s

ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.

CVE-2022-43709: ACP Users SQL injection

MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings.