CVE-2020-35326

The CVE-2020-35326 entry documents a SQL injection vulnerability in the inxedu product, specifically in the WebsiteImagesMapper.xml around the WebsiteImagesMapper code path for inxedu 2.0.6. The underlying issue is an injection flaw caused by an unsafely used id value in the MyBatis mapping file,...

CVE-2020-35326

SQL Injection vulnerability in file /inxedu/demoinxeduopen/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value...

CVE-2023-0243

A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.class.php of the component Article Module. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack...

CVE-2023-0244 TuziCMS KefuController.class.php delall sql injection

A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2023-0244

CVE-2023-0244 affects TuziCMS 2.0.6, exploiting the delall function in App\Manage\Controller\KefuController.class.php by manipulating the id parameter to trigger SQL injection. The issue enables remote exploitation and the vulnerability exploit has been disclosed publicly (VDB-218152). In practic...

CVE-2023-0243

The CVE-2023-0243 entry concerns TuziCMS 2.0.6. Affected: Article Module, ArticleController.class.php, in the index function. Root cause: manipulation of the id argument enables SQL injection. Impact: remote attacker could exploit; public exploit disclosed. Multiple sources corroborate a SQL inje...

PT-2023-16107 · Tuzicms · Tuzicms

Name of the Vulnerable Software and Affected Versions: TuziCMS version 2.0.6 Description: A critical vulnerability was found in TuziCMS, affecting the delall function of the file AppManageControllerKefuController.class.php. The manipulation of the id argument leads to SQL injection. The attack ca...

Froxlor 2.0.6 Remote Command Execution via Arbitrary File Write and Server Side Template Injection

Description Froxlor 2.0.6 Stable is suffering from Remote Command Execution that was achieved by chaining two bugs, the first one is an arbitrary file write on the logging feature, which allows an authenticated attacker to point the log file to any writable path even if it was the web server...

typo3-appointments vulnerable to Cross-site Scripting

A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5. This affects an unknown part of the component Appointment Handler. The manipulation of the argument formfield leads to cross site scripting. It is possible to initiate the attack...

Cross site scripting

A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5 on TYPO3. This affects an unknown part of the component Appointment Handler. The manipulation of the argument formfield leads to cross site scripting. It is possible to initiate the atta...

PT-2023-11352 · Unknown · Innologi Appointments Extension

Name of the Vulnerable Software and Affected Versions: innologi appointments Extension versions up to 2.0.5 Description: A problematic vulnerability was found in the innologi appointments Extension, affecting an unknown part of the component Appointment Handler. The manipulation of the formfield...

CVE-2022-26885 Apache DolphinScheduler config file read by task risk

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

PT-2022-18122 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.0.6 Description: When using tasks to read config files, there is a risk of database password disclosure. Recommendations: For versions prior to 2.0.6, upgrade to version 2.0.6 or higher...

Command injection in Apache DolphinScheduler Alert Plugins

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher...

CVE-2022-45462

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher...

Command injection

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher...

Apache DolphinScheduler path traversal vulnerability

Apache DolphinScheduler, a distributed DAG visualization-based workflow task scheduling system from the Apache Foundation, has a path traversal vulnerability in versions prior to Apache DolphinScheduler 2.0.6, which stems from the failure of a networked system or product to properly filter...

Apache DolphinScheduler vulnerable to Path Traversal

Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher...

GHSA-VPGF-FGM8-GXR2 Apache DolphinScheduler vulnerable to Path Traversal

Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher...

PT-2022-18121 · Apache · Apache Dolphinscheduler

Name of the Vulnerable Software and Affected Versions: Apache DolphinScheduler versions prior to 2.0.6 Description: The issue allows users to read any files by logging into the server. Apache DolphinScheduler users are advised to take action to protect themselves. Recommendations: For versions...