Thelastvvv

A critical issue was found in SialWeb CMS, affecting an unknown part of the file /about.php. The manipulation of the `Id` argument leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

The issue allows SQL injection to occur. This is related to the `offerta.php` parameter.

The issue concerns a cross-site scripting problem. It is related to the "search.php" `id` parameter.

The issue allows SQL Injection via the `username` field on the administrator login page.

The issue concerns a cross-site scripting problem. It is related to the 'certificate.php' file, which suggests that the vulnerability can be exploited through this specific component.

The issue concerns a lack of protection in the web page structure, allowing for potential exploitation. This can lead to a remote attacker conducting a cross-site scripting (XSS) attack. The vulnerability is present in multiple areas, including the online chat, social feed, message title tag, and when adding a new client, where all tags are vulnerable.

The issue is related to a SQL Injection vulnerability via the `id` parameter in the `content.php` script. This vulnerability is due to a lack of protection measures for the SQL query structure. Exploitation of this issue can allow a remote attacker to conduct a cross-site scripting (XSS) attack.

SQL injection can occur via the `cerca/` keywords field. This issue allows for potential data manipulation and unauthorized access.

The issue allows SQL Injection via the `username` field on the administrator login page. This could potentially lead to unauthorized access to sensitive data.

The issue allows for XSS to occur via the cerca/search bar.

An issue was discovered that allows XSS to occur via the `mails/new` title field, a product field to the "p/" URI, or the `Products Search` box.