CVE-2023-37483

CVE-2023-37483 affects SAP PowerDesigner 16.7. The issue is improper access control that could let an unauthenticated attacker run arbitrary queries against the backend database via the proxy. Impact is high (confidentiality, integrity, availability each rated high). Exploitation details are not ...

PT-2023-6500 · Sap · Sap Powerdesigner

Name of the Vulnerable Software and Affected Versions: SAP PowerDesigner version 16.7 Description: The issue is related to improper access control in SAP PowerDesigner, which could allow an unauthenticated attacker to run arbitrary queries against the back-end database via a proxy. This could...

Siemens RUGGEDCOM CROSSBOW SQL注入漏洞

RUGGEDCOM CROSSBOW is a secure access management solution designed to provide NERC CIP compliant access to smart electronic devices. Siemens RUGGEDCOM CROSSBOW suffers from a SQL injection vulnerability that can be exploited by an attacker to execute arbitrary SQL queries on the server database a...

CVE-2023-26439

The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted network were able to perform arbitrary SQL queries, discovering other users cached data. We have...

SQL Injection

moodle/moodle is vulnerable to SQL Injection. The vulnerability exists due to incorrect sorting of the access control table which allows an attacker to inject and execute arbitrary sql queries...

Pimcore SQL注入漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A SQL injection vulnerability exists in Pimcore...

SQL Injection

moodle/moodle is vulnerable to SQL Injection attacks. The vulnerability is due to improper sanitization located in the sort parameter of the enrolgetmycourses function in enrollib.php which allows a malicious attacker to inject and execute arbitrary SQL queries on the system when fetching courses...

CVE-2023-26473 XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm

XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other th...

SQL Injection

github.com/zhaojh329/rttys is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the username parameter via a maliciously registered account allows an attacker to inject and execute arbitrary SQL queries on the target system...

SUSE CVE-2010-1431

SQL injection vulnerability in templatesexport.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the exportitemid parameter...

SUSE CVE-2019-10208

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can...

SQL Injection

github.com/gophergala/sqldump is vulnerable to SQL Injection attacks. A specifically crafted attack statement through multiple functions such as dumptable and dumprecord, allows a malicious user to inject and execute arbitrary SQL queries on the target system...

dobos domino SQL注入漏洞

dobos domino is an individual developer's homework submission system for programming courses. A SQL injection vulnerability exists in dobos domino. An attacker could exploit this vulnerability to perform a sql injection attack...

The vulnerability of the software solution for managing financial indicators of the SAP Business Planning and Consolidation system lies in the lack of measures taken to protect the SQL query structure, allowing attackers to execute arbitrary SQL queries.

The vulnerability of the SAP Business Planning and Consolidation software solution for managing organizational financial indicators is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries...

SQL Injection

github.com/elgs/gosqljson is vulnerable to SQL injection. The vulnerability exists in multiple functions of gosqljson.go due to improper argument handling of the database queries which allows an attacker to inject and execute arbitrary SQL queries...

SQL Injection

knex is vulnerable to SQL Injection attacks. A specifically crafted attack statement through Knex.js allows a malicious user to inject and execute arbitrary SQL queries on the target system, ignoring the WHERE clause of a SQL query...

LetsRecover < 1.2.0 - Admin+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin PoC https://example.com/wp-admin/admin.php?page=letsrecover-manual-notificationid=111+AND+SELECT+5926+FROM+SELECTSLEEP5erUA...

The vulnerability of the web application’s Online Diagnostic Lab Management System lies in the lack of measures taken to protect the SQL query structure, allowing attackers to execute arbitrary SQL queries.

The vulnerability of the Web application, the Online Diagnostic Lab Management System, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries using the...

Delta Electronics DIAEnergie SQL注入漏洞

Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics Taiwan, China used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes and maximize...

SQL Injection

feathers-sequelize is vulnerable to sql injection attacks. The vulnerability exists in thefind function of index.js because the parameters are not properly filtered which allows an attacker to inject and execute arbitrary sql queries...