Search: index.php

512 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 0.6%	CVE-2024-42565ERP · SQL Injection Critical9.8EPSS 0.6%2024-08-20CVE Database V5CVE-2024-42565 ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete. EPSS 0.6%Vulnerability CWE-89	CVE Database V5	2024-08-20
High	7.6	EPSS 0.4%	CVE-2024-42564ERP · SQL Injection High7.6EPSS 0.4%2024-08-20CVE Database V5CVE-2024-42564 ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/inventory/delete?action=delete. EPSS 0.4%Vulnerability CWE-89	CVE Database V5	2024-08-20
Critical	9.8	EPSS 1.0%	CVE-2024-40486 · A SQL Injection Critical9.8EPSS 1.0%2024-08-08CVE Database V5 A SQL injection vulnerability in "/index.php" of Kashipara Live Membership System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email or password Login parameters. EPSS 1.0%Vulnerability CWE-89	CVE Database V5	2024-08-08
Medium	4.7	EPSS 0.8%	CVE-2024-40576Best House Rental Management System · Cross-site Scripting Medium4.7EPSS 0.8%2024-07-29CVE Database V5CVE-2024-40576 Cross Site Scripting vulnerability in Best House Rental Management System 1.0 allows a remote attacker to execute arbitrary code via the "House No" and "Description" parameters in the houses page at the index.php component. EPSS 0.8%Vulnerability CWE-79	CVE Database V5	2024-07-29
Medium	6.1	EPSS 0.4%	CVE-2024-37859Lost · Cross-site Scripting Medium6.1EPSS 0.4%2024-07-29CVE Database V5CVE-2024-37859 Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-07-29
Medium	5.3	EPSS 0.4%	CVE-2024-6573Intelligence (WordPress plugin) · Information Exposure Medium5.3EPSS 0.4%2024-07-27CVE Database V5CVE-2024-6573 The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing direct access to the /vendor/levelten/intel/realtime/index.php file and display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. EPSS 0.4%Vulnerability tomdude CWE-200	CVE Database V5	2024-07-27
Medium	6.5	EPSS 0.4%	CVE-2024-41355phpipam · Cross-site Scripting Medium6.5EPSS 0.4%2024-07-26CVE Database V5CVE-2024-41355 phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-07-26
Medium	5.3	EPSS 0.6%	CVE-2024-6933LimeSurvey · SQL Injection Medium5.3EPSS 0.6%2024-07-21CVE Database V5CVE-2024-6933 A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General Settings Handler. This manipulation of the argument Language causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 6.6.2+240827 can resolve this issue. Patch name: d656d2c7980b7642560977f4780e64533a68e13d. You should upgrade the affected component. EPSS 0.6%Vulnerability	CVE Database V5	2024-07-21
High	7.5	EPSS 0.4%	CVE-2024-39027CMS · SQL Injection High7.5EPSS 0.4%2024-07-05CVE Database V5CVE-2024-39027 SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked. EPSS 0.4%Vulnerability CWE-89	CVE Database V5	2024-07-05
High	7.5	EPSS 0.8%	CVE-2024-39210 · Information Exposure High7.5EPSS 0.8%2024-07-05CVE Database V5 Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability allows attackers to read arbitrary PHP files and access other sensitive information within the application. EPSS 0.8%Vulnerability CWE-200	CVE Database V5	2024-07-05
Critical	9.8	EPSS 0.5%	CVE-2024-39243 · Special Element Injection Critical9.8EPSS 0.5%2024-06-26CVE Database V5 An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save. EPSS 0.5%Vulnerability CWE-75	CVE Database V5	2024-06-26
Medium	6.1	EPSS 0.3%	CVE-2024-37800CodeProjects Restaurant Reservation System · Cross-site Scripting Medium6.1EPSS 0.3%2024-06-18CVE Database V5CVE-2024-37800 CodeProjects Restaurant Reservation System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Date parameter at index.php. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2024-06-18
Medium	6.3	EPSS 0.3%	CVE-2024-37625iBarn · Cross-site Scripting Medium6.3EPSS 0.3%2024-06-17CVE Database V5CVE-2024-37625 zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /index.php. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2024-06-17
High	7.2	EPSS 0.7%	CVE-2024-37621strongshop · Template Injection High7.2EPSS 0.7%2024-06-17CVE Database V5CVE-2024-37621 StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php. EPSS 0.7%Vulnerability CWE-1336	CVE Database V5	2024-06-17
High	7.6	EPSS 0.4%	CVE-2024-37619strongshop · Cross-site Scripting High7.6EPSS 0.4%2024-06-17CVE Database V5CVE-2024-37619 StrongShop v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the spec_group_id parameter at /spec/index.blade.php. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-06-17
Critical	9.1	EPSS 0.6%	CVE-2024-34987PHPGurukul Online Fire Reporting System · SQL Injection Critical9.1EPSS 0.6%2024-06-03CVE Database V5CVE-2024-34987 A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process. EPSS 0.6%Vulnerability CWE-89	CVE Database V5	2024-06-03
Critical	9.8	EPSS 0.7%	CVE-2024-33409 · SQL Injection Critical9.8EPSS 0.7%2024-05-06CVE Database V5 SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the name parameter. EPSS 0.7%Vulnerability CWE-89	CVE Database V5	2024-05-06
High	7.3	EPSS 0.4%	CVE-2024-33406 · SQL Injection High7.3EPSS 0.4%2024-05-06CVE Database V5 SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter. EPSS 0.4%Vulnerability CWE-89	CVE Database V5	2024-05-06
High	8.3	EPSS 0.6%	CVE-2024-33404 · A SQL Injection High8.3EPSS 0.6%2024-05-06CVE Database V5 A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter. EPSS 0.6%Vulnerability CWE-89	CVE Database V5	2024-05-06
High	7.1	EPSS 0.6%	CVE-2024-34469Rukovoditel · Cross-site Scripting High7.1EPSS 0.6%2024-05-04CVE Database V5CVE-2024-34469 Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save. EPSS 0.6%Vulnerability CWE-79	CVE Database V5	2024-05-04

Page 25 of 27