2320 matches found
CVE-2024-35584
A SQL injection vulnerability exists in OpenSIS Community Edition versions 9.1 through 8.0 (and possibly earlier) due to a lack of input sanitization. The application takes arbitrary values from the X-Forwarded-For header and directly appends them into SQL INSERT statements. Specifically, the vul...
CVE-2024-35584
SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to...
CVE-2024-35584: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to...
CVE-2024-9039 SourceCodester Best House Rental Management System ajax.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=signup. The manipulation of the argument firstname/lastname/email leads to sql injection...
CVE-2024-9033 SourceCodester Best House Rental Management System ajax.php cross site scripting
A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=savecategory. The manipulation of the argument name leads to cross site scripting. The...
CVE-2024-9033: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=savecategory. The manipulation of the argument name leads to cross site scripting. The...
CVE-2024-9039: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=signup. The manipulation of the argument firstname/lastname/email leads to sql injection...
CVE-2024-9041: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=updateaccount. The manipulation of the argument firstname/lastname/email leads to sql injection. The attack can...
PT-2024-39377
Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A vulnerability has been found in the system, classified as problematic, affecting an unknown functionality of the file /ajax.php?action=save category. The manipulati...
PT-2024-39383
Name of the Vulnerable Software and Affected Versions SourceCodester Best House Rental Management System version 1.0 Description A critical vulnerability has been found in the system, affecting some unknown functionality of the file "/ajax.php?action=signup". The manipulation of the arguments...
CVE-2024-42794: Improper Access Control
Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=saveuser...
CVE-2024-42794
Kashipara Music Management System v1.0 is susceptible to an Incorrect Access Control vulnerability. The flaw exists in the /music/ajax.php endpoint, specifically when the action parameter is set to save_user, which can lead to unauthorized access. As a workaround, it is recommended to restrict ac...
CVE-2024-8567 itsourcecode Payroll Management System ajax.php sql injection
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=deletedeductions. The manipulation of the argument id leads to sql injection. The attack may be initiated...
CVE-2024-8567: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=deletedeductions. The manipulation of the argument id leads to sql injection. The attack may be initiated...
WordPress WP GDPR Compliance Plugin Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress WP GDPR Compliance Plugin Privilege Escalation', 'Description' = %q The Wordpress GDPR Compliance plugin 'Mikey Veenstra WordFence',...
CVE-2024-42793: Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=saveuser page...
CVE-2024-42792
A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=deleteplaylist page...
CVE-2024-42792: Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery CSRF vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=deleteplaylist page...
CVE-2024-42788
A Stored Cross Site Scripting XSS vulnerability was found in "/music/ajax.php?action=savemusic" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields...
