Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980 environment Build docker environment docker build -t mongo . docker run -dit -p 6666:6666 mongo PoC ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. striptags does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers. id: CVE-2026-52774 info: name: YesWiki Bazar Widget ...

CVE-2023-24775-and-CVE-2023-24780

CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...

CVE-2025-28073

CVE-2025-28073 Descripción sugerida phpList 3.6.3 es vulnerable a Cross-Site Scripting XSS reflejado a través del endpoint /lists/dl.php. Un atacante puede inyectar código JavaScript arbitrario manipulando el parámetro id, que no está saneado adecuadamente. Tipo de vulnerabilidad Cross Site...

rails-cve-2017-17917

rails-cve-2017-17917 The project demonstrates the replication of a SQL injection vulnerability in the id parameter, and subsequently provides insights into mitigating and resolving this security issue. https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917 Stack : Ruby: 3.2.2 Rails: 7.0....

CVE-2023-49989

CVE-2023-49989 Hotel Booking Management v1.0 - SQL Injection Vulnerability in the "id" parameter at update.php Description : Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php. Vulnerable Product Version : Hotel Booking...

CVE-2026-96429

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96429

Flowring Agentflow 4.0 (versions prior to 2025/08/08 ) is vulnerable to SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint. This flaw allows remote attackers to execute arbitrary SQL commands by manipulating the id parameter. The vulnerability has a CRITICAL base severity score ...

EUVD-2026-88658

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2023-49968

CVE-2023-49968 Customer Support System 1.0 - Vulnerabilidad de Inyección SQL en managedepartment.php a través del parámetro URL 'id' Description : Existe una vulnerabilidad de Inyección SQL en la versión 1 del Customer Support System. Un atacante con intenciones maliciosas puede ejecutar comandos...

CVE-2024-10140

CVE-2024-10140 El script explota una vulnerabilidad de inyección SQL encontrada en el endpoint /php/managesupplier.php?action=delete&id=32. La vulnerabilidad permite a un atacante inyectar comandos SQL arbitrarios a través del parámetro id, comprometiendo potencialmente la base de datos y...

CVE-2023-43144

CVE-2023-43144 Description Assets Management System 1.0 is vulnerable to SQL injection via the id parameter in delete.php PoC sqlmap -u 'http://localhost/delete.php?id=4' --cookie="PHPSESSID=SESSID" --dbms=MySQL --dbs --batch Code review delete.php ?php include 'core/init.php'; $id = $GET'id';...

CVE-2021-42670

CVE-2021-42670 CVE-2021-42670 - SQL Injection vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal. An attacker can leverage the vulnerable "id" parameter in the "announcementsstudent.php" web page in orde...

CVE-2024-10354

Source code Petrol pump management software free download | SourceCodester Description SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, A vulnerability has been found that is rated as high risk, affecting some unknown functionality of the admin\print.php file,...

CVE-2024-23747

CVE-2024-23747 The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference IDOR vulnerability. PoC This vulnerability resides in the system's handling of user data access through a /Modernanet/LAUDO/LAU0000100/Laudo?id= URL. Bymanipulating...

CVE-2024-34226

Visitor Management System 1.0 Submitter: Kha Do Vulnerability SQL injection Description SQL injection vulnerability in /php-sqlite-vms/?page=managevisitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters. Affected compone...

CVE-2020-17530

What's this This is a Simple test Project for S2-061 which can be used to analysis the detail of this vulnerability. How to use Step 1:Use IDEA import this project Step 2:setup tomcat Server Step 3:Use browser access...

CVE-2024-41640

Description AML Surety Eco up to version 3.5 is affected by an un-authenticated reflected cross-site scripting. The target web application handles error in a dedicated error page accessible without any authentication containing a URL parameter that is not sanitizing user input. The provided...