PT-2022-26764 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/?page=user/manage user" API endpoint...

PT-2022-26799 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: open5gs version 2.4.11 Description: The issue is related to a memory leak in the component src/smf/pfcp-path.c, which allows attackers to cause a Denial of Service DoS via a crafted PFCP packet. Recommendations: For open5gs version 2.4.11,...

PT-2022-26866 · Unknown · Sanitization Management System

Name of the Vulnerable Software and Affected Versions: Sanitization Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/php-sms/classes/Master.php?f=delete service" endpoint...

CVE-2022-3312

Insufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a local attacker to bypass managed device restrictions via physical access to the device. Chromium security severity: Medium...

PT-2022-26658 · Forma Lms · Forma Lms

Name of the Vulnerable Software and Affected Versions: Forma LMS versions 3.1.0 and earlier Description: The issue allows an authenticated attacker, with the role of a student, to perform a SQL injection on the dyn filter parameter in the "appLms/ajax.adm...

PT-2022-26657 · Forma Lms · Forma Lms

Name of the Vulnerable Software and Affected Versions: Forma LMS versions 3.1.0 and earlier Description: The issue allows an authenticated attacker with the role of student to perform a SQL injection on the id parameter in the "appCore/index.php?r=adm/mediagallery/delete" function. This could...

PT-2022-26022 · Forma Lms · Forma Lms

Name of the Vulnerable Software and Affected Versions: Forma LMS versions 3.1.0 and earlier Description: The issue allows an authenticated attacker with the role of student to perform a SQL injection on the 'searchvalue' parameter in the "appLms/ajax.server.php?r=mycertificate/getMyCertificates"...

PT-2022-20892

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.6 prior to 5.6.9 Spring Security versions 5.7 prior to 5.7.5 Description The issue concerns the potential bypass of authorization rules in Spring Security via forward or include dispatcher types. An application is...

PT-2022-20167 · Inhand Networks · Inrouter302

Name of the Vulnerable Software and Affected Versions: InHand Networks InRouter302 version 3.5.45 Description: A leftover debug code vulnerability exists in the console infct functionality. This vulnerability can be triggered by a specially-crafted series of network requests, leading to the...

PT-2022-10668 · Unknown · Employee Record Management System

Name of the Vulnerable Software and Affected Versions: Employee Record Management System version 1.2 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the editempprofile.php endpoint. Recommendations: For Employee Record Management System version 1....

PT-2022-10759 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue is related to SQL Injection via the Ant Plist.php file. Recommendations: For SEMCMS SHOP version 1.1, consider restricting access to the Ant Plist.php file as a temporary workaround until a patch...

PT-2022-10762 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue is related to SQL Injection via the Ant Zekou.php file. Recommendations: For SEMCMS SHOP version 1.1, update to a version that fixes the SQL Injection issue in Ant Zekou.php, if available. As a...

PT-2022-10765 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue is related to SQL Injection via the Ant Menu.php file. This allows for potential exploitation. Recommendations: For SEMCMS SHOP version 1.1, consider restricting access to the Ant Menu.php file a...

PT-2022-10763 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue affects the Ant Message.php file, allowing for SQL injection. Recommendations: For SEMCMS SHOP version 1.1, consider restricting access to the Ant Message.php file until a patch is available. As ...

PT-2022-5350 · Sudo +5 · Sudo +5

Name of the Vulnerable Software and Affected Versions: Sudo versions 1.8.0 through 1.9.12 Description: The issue is related to an array-out-of-bounds error in the plugins/sudoers/auth/passwd.c file of the Sudo program when using the crypt password backend. This error can result in a heap-based...

PT-2022-23794 · WordPress · Web Stories

Name of the Vulnerable Software and Affected Versions: Web Stories plugin for WordPress versions up to, and including 1.24.0 Description: The issue arises from insufficient validation of URLs supplied via the url parameter in the "/v1/hotlink/proxy" REST API Endpoint. This allows authenticated...

PT-2022-10761 · Unknown · Semcms Shop

Name of the Vulnerable Software and Affected Versions: SEMCMS SHOP version 1.1 Description: The issue is related to SQL Injection, which can be exploited via the Ant Info.php file. Recommendations: For SEMCMS SHOP version 1.1, consider restricting access to the Ant Info.php file as a temporary...

PT-2022-25996 · Haas · Haas Controller

Name of the Vulnerable Software and Affected Versions: Haas Controller version 100.20.000.1110 Description: The issue concerns the transmission of communication traffic involving the "Ethernet Q Commands" service in cleartext. This allows an attacker to obtain sensitive information being passed t...

PT-2022-25152 · Unknown · School Activity Updates With Sms Notification

Name of the Vulnerable Software and Affected Versions: School Activity Updates with SMS Notification version 1.0 Description: A SQL injection issue was discovered via the id parameter at the "/modules/announcement/index.php?view=edit&id=" endpoint. This allows for potential exploitation of the SQ...

PT-2022-26004 · Unknown · Diaenergie

Name of the Vulnerable Software and Affected Versions: DIAEnergie versions prior to v1.9.01.002 Description: The issue concerns a stored cross-site scripting vulnerability. This vulnerability can be exploited through the SetPF API. Recommendations: For versions prior to v1.9.01.002, update to...