Weakness (CWE)
CWE-707: Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being used when received from an upstream component, or before being sent to a downstream component.
Source: MITRE CWE-707
264 results · Feed
-
Low 3.5
Movie Ticket Booking System booking.php cross site scripting
A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown functionality of the file booking.php. The manipulation of the argument id leads to cross site scripting. The attack can …
-
Medium 5.0
Movie Ticket Booking System editBooking.php sql injection
A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBooking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated r…
-
Low 3.5
SourceCodester Canteen Management System customer.php builtin_echo cross site scripting
A vulnerability was found in SourceCodester Canteen Management System. It has been declared as problematic. This vulnerability affects the function builtin_echo of the file customer.php. The manipulation leads to cross site scripting. The attack can be initia…
-
Low 3.5
Movie Ticket Booking System POST Request cross site scripting
A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the component POST Request Handler. The manipulation of the argument ORDER_ID leads to cross site scripting. It is possible to l…
-
Medium 6.3CVE-2022-4257 EPSS 44%
C-DATA Web Management System GET Parameter jumpto.php argument injection
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argu…
-
Medium 6.3
Movie Ticket Booking System booking.php sql injection
A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has…
-
Low 3.5
SourceCodester Canteen Management System categories.php builtin_echo cross site scripting
A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function builtin_echo of the file categories.php. The manipulation leads to cross site scripting. It is possible to initiate the att…
-
Low 2.4
Movie Ticket Booking System editBooking.php cross site scripting
A vulnerability was found in Movie Ticket Booking System and classified as problematic. Affected by this issue is some unknown functionality of the file editBooking.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The …
-
Medium 5.0
SourceCodester Canteen Management System POST Request ajax_invoice.php query sql injection
A vulnerability was found in SourceCodester Canteen Management System. It has been rated as critical. This issue affects the function query of the file ajax_invoice.php of the component POST Request Handler. The manipulation of the argument search leads to sq…
-
Low 3.5
SourceCodester Canteen Management System brand.php builtin_echo cross site scripting
A vulnerability was found in SourceCodester Canteen Management System. It has been rated as problematic. This issue affects the function builtin_echo of the file youthappam/brand.php. The manipulation of the argument brand_name leads to cross site scripting. …
-
Low 2.4
SourceCodester Event Registration System cross site scripting
A vulnerability has been found in SourceCodester Event Registration System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /event/admin/?page=user/list. The manipulation of the argument First Name/Last…
-
Medium 6.3
Sapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injection
A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown functionality of the file ip/syscmd.htm. The manipulation leads to os command injection. The attack may be launched remotel…
-
Low 3.5
SourceCodester Canteen Management System food.php query cross site scripting
A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function query of the file food.php. The manipulation of the argument product_name leads to cross site scripting. It is possible to …
-
Medium 4.3
rickxy Stock Management System processlogin.php cross site scripting
A vulnerability was found in rickxy Stock Management System. It has been declared as problematic. This vulnerability affects unknown code of the file /pages/processlogin.php. The manipulation of the argument user leads to cross site scripting. The attack can …
-
High 7.3
rickxy Stock Management System processlogin.php sql injection
A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality of the file /pages/processlogin.php. The manipulation of the argument user/password leads to sql injection. The attack…
-
Low 3.7
Dalli Meta Protocol request_formatter.rb self.meta_set injection
A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation of the argument cas…
-
Low 2.4
Student Attendance Management System createClass.php cross site scripting
A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. It is possible to …
-
Medium 4.7
Student Attendance Management System createClass.php sql injection
A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/createClass.php. The manipulation of the argument Id leads to sql injection. The attack may be initiate…
-
Medium 6.3
Hostel Searching Project view-property.php sql injection
A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. The manipulation of the argument property_id leads to sql injection. The attack can be initiated remo…
-
Medium 4.7
Sports Club Management System make_payments.php sql injection
A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments.php. The manipulation of the argument m_id/plan leads to sql injection. It is possible to initiate …
-
Medium 6.5
Simple History Plugin Header neutralization for logs
A vulnerability was found in Simple History Plugin. It has been rated as critical. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. T…
-
Medium 6.3
Hospital Management Center patient-info.php sql injection
A vulnerability classified as critical has been found in Hospital Management Center. Affected is an unknown function of the file patient-info.php. The manipulation of the argument pt_id leads to sql injection. It is possible to launch the attack remotely. The…
-
Medium 6.3
MonikaBrzica scm uredi_korisnika.php sql injection
A vulnerability, which was classified as critical, was found in MonikaBrzica scm. This affects an unknown part of the file uredi_korisnika.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exp…
-
Medium 6.3
MonikaBrzica scm upis_u_bazu.php sql injection
A vulnerability, which was classified as critical, has been found in MonikaBrzica scm. Affected by this issue is some unknown functionality of the file upis_u_bazu.php. The manipulation of the argument email/lozinka/ime/id leads to sql injection. The attack m…
-
Low 3.5
Frappe Search navbar_search.html cross site scripting
A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cr…
-
Low 2.4CVE-2022-3992 Public exploit
SourceCodester Sanitization Management System Banner Image cross site scripting
A vulnerability classified as problematic was found in SourceCodester Sanitization Management System. Affected by this vulnerability is an unknown functionality of the file admin/?page=system_info of the component Banner Image Handler. The manipulation leads …
-
Medium 5.3
Vesta Control Panel sed main.sh argument injection
A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. T…
-
High 7.3
Pingkon HMS-PHP adminlogin.php sql injection
A vulnerability was found in Pingkon HMS-PHP. It has been rated as critical. This issue affects some unknown processing of the file admin/adminlogin.php. The manipulation of the argument uname/pass leads to sql injection. The attack may be initiated remotely.…
-
Low 3.5
NukeViet CMS Data URL Request.php filterAttr cross site scripting
A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument at…
-
Medium 4.6
matrix-appservice-irc PgDataStore.ts sql injection
A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgr…
-
Low 3.5
emlog article_save.php cross site scripting
A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launche…
-
High 7.3
Pingkon HMS-PHP Data Pump Metadata admin.php sql injection
A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to l…
-
Low 3.5
gnuboard5 FAQ Key ID faq.php cross site scripting
A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to cross site scripting. It is possible to…
-
Low 3.5
sanluan PublicCMS Tab dwz.min.js initLink cross site scripting
A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component Tab Handler. The manipulation leads to cross site scripting. It is possible to launch the attack re…
-
Medium 4.3CVE-2022-3942 Public exploit
SourceCodester Sanitization Management System cross site scripting
A vulnerability was found in SourceCodester Sanitization Management System and classified as problematic. This issue affects some unknown processing of the file php-sms/?p=request_quote. The manipulation leads to cross site scripting. The attack may be initia…
-
Medium 6.3
eolinker goku_lite getList sql injection
A vulnerability classified as critical was found in eolinker goku_lite. This vulnerability affects unknown code of the file /plugin/getList. The manipulation of the argument route/keyword leads to sql injection. The attack can be initiated remotely. The explo…
-
High 7.3
tholum crm42 Login class.user.php sql injection
A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\class\class.user.php of the component Login. The manipulation of the argument user_name leads to sql injection. The attack m…
-
Low 3.5
ForU CMS cms_chip.php cross site scripting
A vulnerability was found in ForU CMS. It has been classified as problematic. Affected is an unknown function of the file cms_chip.php. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The expl…
-
Medium 5.3
Activity Log Plugin HTTP Header neutralization for logs
A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. …
-
Low 3.5CVE-2022-3949 Public exploit
Sourcecodester Simple Cashiering System User Account cross site scripting
A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of the component User Account Handler. The manipulation of the argument fullname leads to cross site sc…