stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2017-17584 (severity: CRITICAL, weakness: CWE-89)
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
CVE-2017-17585 (severity: CRITICAL, weakness: CWE-89)
FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.
CVE-2017-17586 (severity: CRITICAL, weakness: CWE-89)
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter.
CVE-2017-17587 (severity: CRITICAL, weakness: CWE-89)
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter.
CVE-2017-17588 (severity: CRITICAL, weakness: CWE-89)
FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id parameter.
CVE-2017-17589 (severity: CRITICAL, weakness: CWE-89)
FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parameter.
CVE-2017-17590 (severity: CRITICAL, weakness: CWE-89)
FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.
CVE-2017-17591 (severity: CRITICAL, weakness: CWE-89)
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
CVE-2017-17592 (severity: CRITICAL, weakness: CWE-89)
Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.
CVE-2017-17593 (severity: HIGH, weakness: CWE-434)
Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/.
CVE-2017-17594 (severity: CRITICAL, weakness: CWE-89)
DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.
CVE-2017-17595 (severity: CRITICAL, weakness: CWE-89)
Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.
CVE-2017-17596 (severity: CRITICAL, weakness: CWE-89)
Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
CVE-2017-17597 (severity: CRITICAL, weakness: CWE-89)
Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.
CVE-2017-17598 (severity: CRITICAL, weakness: CWE-89)
Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.
CVE-2017-17599 (severity: CRITICAL, weakness: CWE-89)
Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter.
CVE-2017-1760 (severity: HIGH, weakness: NVD-CWE-Other)
IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose some sensitive information. IBM X-Force ID: 126454.
CVE-2017-17600 (severity: CRITICAL, weakness: CWE-89)
Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.
CVE-2017-17601 (severity: CRITICAL, weakness: CWE-89)
Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.
CVE-2017-17602 (severity: CRITICAL, weakness: CWE-89)
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
CVE-2017-17603 (severity: CRITICAL, weakness: CWE-89)
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_price, or maxprice parameter.
CVE-2017-17604 (severity: CRITICAL, weakness: CWE-89)
Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.
CVE-2017-17605 (severity: CRITICAL, weakness: CWE-89)
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
CVE-2017-17606 (severity: CRITICAL, weakness: CWE-89)
Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-17607 (severity: CRITICAL, weakness: CWE-89)
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
CVE-2017-17608 (severity: CRITICAL, weakness: CWE-89)
Child Care Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-17609 (severity: CRITICAL, weakness: CWE-89)
Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
CVE-2017-1761 (severity: MEDIUM, weakness: CWE-79)
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136005.
CVE-2017-17610 (severity: CRITICAL, weakness: CWE-89)
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter.
CVE-2017-17611 (severity: CRITICAL, weakness: CWE-89)
Doctor Search Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-17612 (severity: CRITICAL, weakness: CWE-89)
Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.
CVE-2017-17613 (severity: CRITICAL, weakness: CWE-89)
Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php catid parameter.
CVE-2017-17614 (severity: CRITICAL, weakness: CWE-89)
Food Order Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-17615 (severity: HIGH, weakness: CWE-89)
Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.
CVE-2017-17616 (severity: CRITICAL, weakness: CWE-89)
Event Search Script 1.0 has SQL Injection via the /event-list city parameter.
CVE-2017-17617 (severity: CRITICAL, weakness: CWE-89)
Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.
CVE-2017-17618 (severity: CRITICAL, weakness: CWE-89)
Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter.
CVE-2017-17619 (severity: CRITICAL, weakness: CWE-89)
Laundry Booking Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-1762 (severity: MEDIUM, weakness: CWE-79)
IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136006.
CVE-2017-17620 (severity: CRITICAL, weakness: CWE-89)
Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.
CVE-2017-17621 (severity: CRITICAL, weakness: CWE-89)
Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.
CVE-2017-17622 (severity: CRITICAL, weakness: CWE-89)
Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.
CVE-2017-17623 (severity: CRITICAL, weakness: CWE-89)
Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.
CVE-2017-17624 (severity: CRITICAL, weakness: CWE-89)
PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat or chid1 parameter.
CVE-2017-17625 (severity: CRITICAL, weakness: CWE-89)
Professional Service Script 1.0 has SQL Injection via the service-list city parameter.
CVE-2017-17626 (severity: CRITICAL, weakness: CWE-89)
Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.
CVE-2017-17627 (severity: CRITICAL, weakness: CWE-89)
Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.
CVE-2017-17628 (severity: CRITICAL, weakness: CWE-89)
Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.
CVE-2017-17629 (severity: CRITICAL, weakness: CWE-89)
Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parameter.
CVE-2017-17630 (severity: CRITICAL, weakness: CWE-89)
Yoga Class Script 1.0 has SQL Injection via the /list city parameter.
CVE-2017-17631 (severity: CRITICAL, weakness: CWE-89)
Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.
CVE-2017-17632 (severity: CRITICAL, weakness: CWE-89)
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
CVE-2017-17633 (severity: CRITICAL, weakness: CWE-89)
Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid parameter.
CVE-2017-17634 (severity: CRITICAL, weakness: CWE-89)
Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
CVE-2017-17635 (severity: CRITICAL, weakness: CWE-89)
MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.
CVE-2017-17636 (severity: CRITICAL, weakness: CWE-89)
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
CVE-2017-17637 (severity: CRITICAL, weakness: CWE-89)
Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
CVE-2017-17638 (severity: CRITICAL, weakness: CWE-89)
Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.
CVE-2017-17639 (severity: CRITICAL, weakness: CWE-89)
Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.
CVE-2017-1764 (severity: HIGH, weakness: CWE-522)
IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user. IBM X-Force ID: 136149.
CVE-2017-17640 (severity: CRITICAL, weakness: CWE-89)
Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter.
CVE-2017-17641 (severity: CRITICAL, weakness: CWE-89)
Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.
CVE-2017-17642 (severity: CRITICAL, weakness: CWE-89)
Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.
CVE-2017-17643 (severity: CRITICAL, weakness: CWE-89)
FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.
CVE-2017-17645 (severity: CRITICAL, weakness: CWE-89)
Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.
CVE-2017-17648 (severity: CRITICAL, weakness: CWE-89)
Entrepreneur Dating Script 2.0.1 has SQL Injection via the search_result.php marital, gender, country, or profileid parameter.
CVE-2017-17649 (severity: MEDIUM, weakness: CWE-94)
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
CVE-2017-1765 (severity: MEDIUM, weakness: CWE-200)
IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-Force ID: 136150.
CVE-2017-17651 (severity: CRITICAL, weakness: CWE-89)
Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter.
CVE-2017-17652 (severity: CRITICAL, weakness: CWE-89)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup Count method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4238.
CVE-2017-17653 (severity: CRITICAL, weakness: CWE-89)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupOptionSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4286.
CVE-2017-17654 (severity: CRITICAL, weakness: CWE-89)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup ClientList method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4287.
CVE-2017-17655 (severity: CRITICAL, weakness: CWE-89)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup PluginList method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4289.
CVE-2017-17656 (severity: CRITICAL, weakness: CWE-89)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup JobList method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4292.
CVE-2017-17657 (severity: CRITICAL, weakness: CWE-89)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup TimeRange method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4294.
CVE-2017-17658 (severity: CRITICAL, weakness: CWE-89)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobDefinitions Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4316.
CVE-2017-17659 (severity: CRITICAL, weakness: CWE-89)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobHistory Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4906.
CVE-2017-1766 (severity: MEDIUM, weakness: CWE-863)
Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151.
CVE-2017-17662 (severity: HIGH, weakness: CWE-22)
Directory traversal in the HTTP server on Yawcam 0.2.6 through 0.6.0 devices allows attackers to read arbitrary files through a sequence of the form '.x./' or '....\x/' where x is a pattern composed of one or more (zero or more for the second pattern) of either \ or ..\ -- for example a '.\./', '....\/' or '...\./' sequence. For files with no extension, a single dot needs to be appended to ensure the HTTP server does not alter the request, e.g., a "GET /.\./.\./.\./.\./.\./.\./.\./windows/system32/drivers/etc/hosts." request.
CVE-2017-17663 (severity: CRITICAL, weakness: CWE-119)
The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.
CVE-2017-17664 (severity: MEDIUM, weakness: CWE-119)
A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack.
CVE-2017-17665 (severity: HIGH, weakness: CWE-862)
In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.
CVE-2017-17668 (severity: HIGH, weakness: CWE-863)
Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities.
CVE-2017-17669 (severity: MEDIUM, weakness: CWE-125)
There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack.
CVE-2017-1767 (severity: MEDIUM, weakness: CWE-79)
IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 136152.
CVE-2017-17670 (severity: HIGH, weakness: CWE-416)
In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.
CVE-2017-17671 (severity: CRITICAL, weakness: CWE-22)
vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.
CVE-2017-17672 (severity: CRITICAL, weakness: CWE-502)
In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
CVE-2017-17674 (severity: CRITICAL, weakness: CWE-918)
BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE).
CVE-2017-17675 (severity: MEDIUM, weakness: CWE-532)
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data.
CVE-2017-17677 (severity: HIGH, weakness: CWE-732)
BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code.
CVE-2017-17678 (severity: MEDIUM, weakness: CWE-79)
BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility.
CVE-2017-1768 (severity: MEDIUM, weakness: CWE-200)
IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 136471.
CVE-2017-17680 (severity: MEDIUM, weakness: CWE-772)
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of service via a crafted xpm image file.
CVE-2017-17681 (severity: MEDIUM, weakness: CWE-835)
In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted psd image file.
CVE-2017-17682 (severity: MEDIUM, weakness: CWE-400)
In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted wpg image file that triggers a ReadWPGImage call.
CVE-2017-17683 (severity: HIGH, weakness: CWE-119)
Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request.
CVE-2017-17684 (severity: HIGH, weakness: CWE-119)
Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request.
CVE-2017-17688 (severity: MEDIUM, weakness: NVD-CWE-Other)
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification
CVE-2017-17689 (severity: MEDIUM, weakness: NVD-CWE-Other)
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
CVE-2017-1769 (severity: HIGH, weakness: CWE-352)
IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 136783.
CVE-2017-17691 (severity: HIGH, weakness: CWE-522)
Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client instances, which allows remote attackers to obtain sensitive information via a man in the middle attack.
CVE-2017-17692 (severity: HIGH, weakness: CWE-200)
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property.
CVE-2017-17693 (severity: MEDIUM, weakness: CWE-862)
Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.
CVE-2017-17694 (severity: MEDIUM, weakness: CWE-79)
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.
CVE-2017-17695 (severity: HIGH, weakness: CWE-89)
Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.
CVE-2017-17696 (severity: MEDIUM, weakness: CWE-200)
Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.