PT-2022-26368 · Sourcecodester · Sourcecodester Event Registration System

Name of the Vulnerable Software and Affected Versions: SourceCodester Event Registration System version 1.0 Description: A vulnerability has been found in the SourceCodester Event Registration System, allowing for cross site scripting through the manipulation of the First Name/Last Name argument ...

CVE-2022-44294

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manageservice&id=...

PT-2022-27570 · Aerocms · Aerocms

Name of the Vulnerable Software and Affected Versions: AeroCMS version 0.0.1 Description: The issue allows attackers to access database information through a SQL Injection vulnerability. This vulnerability is exploited via the id parameter at the "admin/post comments.php" endpoint. Recommendation...

PT-2022-27318 · Unknown · Automotive Shop Management System

Name of the Vulnerable Software and Affected Versions: Automotive Shop Management System version 1.0 Description: The issue concerns a SQL Injection vulnerability. It can be exploited via the "/asms/admin/?page=transactions/manage transaction&id=" endpoint, specifically through the id variable...

PT-2022-27214 · Unknown · Automotive Shop Management System

Name of the Vulnerable Software and Affected Versions: Automotive Shop Management System version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the "/asms/admin/?page=user/manage user&id=" endpoint. The id parameter is vulnerable to this type of attack. No...

PT-2022-26789 · Unknown · Online Leave Management System

Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It affects the /admin/?page=user/manage user&id= component. This vulnerability can be exploited via the id variable. Recommendation...

Authenticated SQL injection via filename & update-instance parameters

There is a SQL injection vulnerability inside saveMeta function in AttachmentAbstract.php. When a file is being uploaded via admin/index.php?action=ajax&ajax=att&ajaxaction=upload endpoint, the filename parameter isn't being sanitized and its later on interpolated into a raw SQL query inside...

PT-2022-25175 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: Flatpress version 1.2.1 Description: A reflected cross-site scripting XSS issue was found in Flatpress. The issue is related to the page parameter at the "/flatpress/admin.php" API endpoint. This allows for potential XSS attacks...

PT-2022-25828 · Unknown · Online Pet Shop We App

Name of the Vulnerable Software and Affected Versions: Online Pet Shop We App version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/pet shop/admin/?page=maintenance/manage category" API endpoint...

PT-2022-26334 · Unknown · Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: Simple Cold Storage Management System version 1.0 Description: The issue is related to SQL injection via the /csms/admin/inquiries/view details.php?id= endpoint. The id variable is vulnerable to SQL injection attacks. Recommendations: For...

PT-2022-25357 · Unknown · Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue is a SQL injection vulnerability. It can be exploited via the id parameter at the "/admin/up booking.php" API endpoint. Recommendations: For Online Tours & Travels...

PT-2022-25201 · Unknown · Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/update expense category.php" API endpoint...

PT-2022-25390 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: The issue is related to a SQL injection vulnerability. It occurs via the keyword parameter at the "/admin/baojia list.php" API endpoint. Recommendations: For ZZCMS version 2022, avoid using the keyword paramete...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a crafted request sent to the /admin/users/userid/memberships/membershipid endpoint containing an additional membershipentityid parameter. This will allow an attacker to update the...

JFinal SQL注入漏洞

JFinal is a Java-based WEB + ORM open source framework. JFinal CMS version 5.1.0 has a security vulnerability , the vulnerability stems from /admin/comment/list SQL injection vulnerability...

PT-2022-23556 · Unknown · Ingredients Stock Management System

Name of the Vulnerable Software and Affected Versions: Ingredients Stock Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the month parameter at the "/admin/?page=reports/waste&month=" endpoint...

PT-2022-23015 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.8 Description: The issue is related to incorrect access control for admin functionality at the "/users" endpoint. This lack of access control can be leveraged to perform a cross-site scripting attack...

PT-2022-3299 · Trueconf · Trueconf Server

Name of the Vulnerable Software and Affected Versions: TrueConf Server version 4.3.7 Description: A vulnerability has been found in the /admin/conferences/get-all-status/ component of TrueConf Server, related to the failure to neutralize script-related HTML tags on a web page. The manipulation of...

PT-2022-8292 · Wolfcms · Wolf Cms

Name of the Vulnerable Software and Affected Versions: WolfCMS versions up to 0.8.3.1 Description: A vulnerability was found in WolfCMS that affects the processing of the file /wolfcms/?/admin/user/add of the component User Add. The manipulation of the name argument leads to basic cross site...

CSCMS Music Portal System SQL注入漏洞

CSCMS Music Portal System is a diversified content management system from China Sunshine Network Technology CSCMS, Inc. A SQL injection vulnerability exists in CSCMS Music Portal System, which stems from the lack of validation of the id parameter of /admin.php/pic/admin/type/del against external...