SQL injection vulnerability in search.asp in Xigla Absolute Form Processor XE 4.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.
Product
xigla absolute form processor xe vulnerabilities
2 published CVES affecting xigla absolute form processor xe, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest xigla absolute form processor xe CVEs
Newest publication first
-
MediumCVSS 6.5 EPSS 0.99%
-
MediumCVSS 4.3 EPSS 1.3%
Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute Form Processor XE 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) showfields, (2) text, and (3) submissions parameters to search.asp and the (4) name parameter to users.asp. NOTE:...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.