Rem0Ve

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including the find or replace fields to "havalite/findReplace.php", the `username` parameter to "havalite/hava login.php", the Edit Article module, "hava post.php" in the postAuthor module, the `postId` parameter to "hava post.php", the `userId` parameter to "hava user.php", or the `linkId` parameter to "hava link.php".

The issue allows remote authenticated users to inject arbitrary web script or HTML via the Troubleshooting in the Trace route Device module or the LDAP Username in the LDAP Configuration module.

The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via the `invoice number` or `tags` parameter to the "index.php/invoice search" endpoint.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `first name` or `last name` parameters in the "index.php/users/form/user id" API endpoint.

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `viewId` parameter to "fault/AlarmView.do" or the `period` parameter to "showHistoryData.do".

The issue allows remote attackers to inject arbitrary web script or HTML via several vectors, including the Endpoint Monitor, Dialup List, or Log&Report Display modules. Additionally, the `fields sorted opt` parameter to `/user/auth/list` or `/endpointcompliance/app detect/predefined sig list` API endpoints is vulnerable. This is due to insufficient protection of the web page structure, which can be exploited by a remote attacker to inject arbitrary JavaScript or HTML code.