0xUhaw/CVE-Bins

GitHub

github.com

Releases0

Stars8

This our note

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2019-7660 ↗	Mar 7, 2019Thursday, 7 March 2019, 23:29	—	4.3 MEDIUM
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting (XSS) vulnerability, as demonstrated by admin/login.php.
CVE-2019-7661 ↗	Mar 7, 2019Thursday, 7 March 2019, 23:29	—	4.3 MEDIUM
An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected Cross-site Scripting (XSS) vulnerability.
CVE-2019-7547 ↗	Feb 6, 2019Wednesday, 6 February 2019, 21:29	—	3.5 LOW
An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name containing an XSS Payload, leading to stored XSS.
CVE-2019-7543 ↗	Feb 6, 2019Wednesday, 6 February 2019, 21:29	—	4.3 MEDIUM
In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.
CVE-2019-7544 ↗	Feb 6, 2019Wednesday, 6 February 2019, 21:29	—	3.5 LOW
An issue was discovered in MyWebSQL 3.7. The Add User function of the User Manager pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name Field.
CVE-2019-7545 ↗	Feb 6, 2019Wednesday, 6 February 2019, 21:29	—	3.5 LOW
In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field.
CVE-2019-7546 ↗	Feb 6, 2019Wednesday, 6 February 2019, 21:29	—	4.3 MEDIUM
An issue was discovered in SIDU 6.0. The dbs parameter of the conn.php page has a reflected Cross-site Scripting (XSS) vulnerability.
CVE-2018-19435 ↗	Nov 22, 2018Thursday, 22 November 2018, 05:29	—	6.5 MEDIUM
An issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parameter.
CVE-2018-19436 ↗	Nov 22, 2018Thursday, 22 November 2018, 05:29	—	6.5 MEDIUM
An issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parameter.
CVE-2018-19340 ↗	Nov 17, 2018Saturday, 17 November 2018, 17:29	—	4.3 MEDIUM
Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCountry, Freight, or details parameter.