557 matches found
CVE-2023-7147: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 i...
CVE-2023-7159: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. T...
PT-2023-32914 · Unknown · Gopeak Masterlab
Name of the Vulnerable Software and Affected Versions: gopeak MasterLab versions up to 3.3.10 Description: A critical issue has been found in the function add/update of the file app/ctrl/admin/User.php, where the manipulation of the avatar argument leads to unrestricted upload. This issue can be...
Sql injection
A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manageuser.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The...
CVE-2023-6464: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument user leads to sql injection. The attack may be launched remotely...
CVE-2023-6462: Improper Neutralization of Input During Web Page Generation
A vulnerability, which was classified as problematic, was found in SourceCodester User Registration and Login System 1.0. Affected is an unknown function of the file /endpoint/delete-user.php. The manipulation of the argument user leads to cross site scripting. It is possible to launch the attack...
CVE-2023-6463: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument firstname leads to cross site scripting. The attac...
PT-2023-31032 · Klive · Klive
Name of the Vulnerable Software and Affected Versions: 32ns KLive versions 2019-1-19 and earlier Description: The issue allows a remote attacker to obtain sensitive information via a crafted script to the "web/user.php" component. This is achieved through a SQL Injection attack, which enables the...
CVE-2023-49030: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in32ns KLive v.2019-1-19 and before allows a remote attacker to obtain sensitive information via a crafted script to the web/user.php component...
CVE-2023-43014
Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'firstname' and 'lastname' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents...
Sql injection
Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'firstname' and 'lastname' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents...
CVE-2023-43014
CVE-2023-43014 relates to Asset Management System v1.0 with an authenticated SQL Injection in the fields “first_name” and “last_name” on the user.php page. The underlying issue is improper input handling that enables an authenticated attacker to dump the database contents. Documented impact is hi...
CVE-2023-43014 Asset Management System v1.0 - Authenticated SQL Injection (SQLi)
Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'firstname' and 'lastname' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents...
CVE-2023-43014: Improper Neutralization of Special Elements used in an SQL Command
Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'firstname' and 'lastname' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents...
Impress CMS 1.3.9 Open Redirection
==================================================================================================================================== | Title : impress CMS v1.3.9 Open Redirect vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bit ...
Sql injection
A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file vm\patient\edit-user.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to...
CVE-2023-4444: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file vm\patient\edit-user.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to...
emlog SQL Injection Vulnerability
emlog is a PHP and MySQL based CMS builder for emlog personal developers. A SQL injection vulnerability exists in emlog version 2.1.9, which stems from the lack of validation of externally entered SQL statements in the file /admin/user.php. An attacker can exploit this vulnerability to execute...