CVE-2024-20532

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

CVE-2024-47651 Parameter Pollution Vulnerability

This vulnerability exists in Shilpi Client Dashboard due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this vulnerability by including multiple “userid” parameters in the API request body leading to unauthorized access of sensitive...

CVE-2024-47087

This vulnerability exists in Apex Softcell LD Geo due to improper validation of the certain parameters Client ID, DPID or BOID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to exposure of sensitive...

PT-2024-20292 · Unknown · Sourcecodester Daily Habit Tracker

Name of the Vulnerable Software and Affected Versions: Sourcecodester Daily Habit Tracker App version 1.0 Description: The issue allows SQL Injection via the parameter tracker. Recommendations: For Sourcecodester Daily Habit Tracker App version 1.0, avoid using the parameter tracker in the affect...

Sql injection

Blind SQL injection in apiid parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query...

Improper Privilege Management

microweber/microweber is vulnerable to Improper Privilege Management . The vulnerability exists due lack of authorization checks in the apiResource parameter of api.php which allows an attacker to provide malicious configuration-related API parameter...

Code injection

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2022-45608

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2022-45608

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2022-45608

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2022-39041

aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database...

CVE-2022-39041

aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database...

CVE-2022-39041 aEnrich a+HRD - SQL Injection

aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database...

PT-2023-13674 · Unknown · Aenrich A+Hrd

Name of the Vulnerable Software and Affected Versions: aEnrich a+HRD affected versions not specified Description: The issue is related to insufficient user input validation for a specific API parameter, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. This can lead to...

CVE-2022-20926

A vulnerability in the web management interface of the Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient validation of user-supplied parameters for...

CVE-2022-23770 WISA Smart Wing CMS Remote Command Execution Vulnerability

This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attackers could use this vulnerability to execute malicious commands such as directory traversal...

CVE-2022-28811 Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands...

CVE-2022-0879

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting...

CVE-2022-0879

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting...

CVE-2021-37215

The employee management page of Flygo contains an Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user data by specifying that employee’s ID in the API parameter...