CVE’s

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in hmsget_doctor.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in hmsappointment-history.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in hmschange-emaild.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

PHPGurukul Hospital Management System in PHP v4.0 has a Persistent Cross-Site Scripting vulnerability in hmsadminappointment-history.php. Remote registered users can exploit the vulnerability to obtain user cookie data.

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in hmsforgot-password.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in hmsuser-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in hmscheck_availability.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information.

A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password.

MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the "path" or "Services+ID" parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS, an attacker must modify the "name" parameter with the malicious code.