CVE-2020-20296

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20294

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

CVE-2020-20295

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands...

Sql injection

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

Sql injection

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands...

Command injection

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

CVE-2020-20296

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20296

CMSWing 1.3.8 contains a SQL injection vulnerability in the rechargeAction path where the balance parameter is not validated, allowing malicious parameters to execute arbitrary SQL commands. This is documented across multiple sources (CVE-2020-20296) with high severity (CVSSv3.1: 9.8) and partial...

CVE-2020-20296

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20295

CMSWing 1.3.8 contains a SQL injection vulnerability: the updateAction function does not validate the detail parameter, allowing an attacker to supply malicious input and execute arbitrary SQL commands. Affected component: updateAction path handling, within CMSWing’s backend. Impact described in ...

CVE-2020-20295

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20295

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20294

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

CVE-2020-20294

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

CVE-2020-20294

CVE-2020-20294 affects CMSWing 1.3.8. The issue is a log function not validating the log parameter, allowing arbitrary command execution through malicious input. No explicit exploitation details or patch/remediation are provided in the supplied documents.

CMSWing SQL injection vulnerability

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. A SQL injection vulnerability exists in CMSWing 1.3.8. The vulnerability stems from the rechargeAction function not checking the balance parameter. An attacker can exploit this vulnerability to execute arbitrary SQL commands via...

CVE-2020-20296: Improper Neutralization of Special Elements used in an SQL Command

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20295: Improper Neutralization of Special Elements used in an SQL Command

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20294: Improper Neutralization of Special Elements used in an SQL Command

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

PT-2021-10476

Name of the Vulnerable Software and Affected Versions: CMSWing version 1.3.8 Description: An issue was found in the CMSWing project where the rechargeAction function does not check the balance parameter, allowing malicious parameters to execute arbitrary SQL commands. Recommendations: For CMSWing...