CVE-2022-30454: Improper Neutralization of Special Elements used in an SQL Command

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteproduct...

CVE-2022-30463: Improper Neutralization of Special Elements used in an SQL Command

Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=deleteproduct...

PT-2022-20127

Name of the Vulnerable Software and Affected Versions Simple Social Networking Site version 1.0 Description The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the API endpoint "/sns/classes/Users.php?f=save" by manipulating the firstname variable. This allows an...

CVE-2022-30461: Improper Neutralization of Special Elements used in an SQL Command

Water-billing-management-system v1.0 is vulnerable to SQL Injection via /wbms/classes/Master.php?f=deleteclient, id...

CVE-2022-30460: Improper Neutralization of Input During Web Page Generation

Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting XSS via /sns/classes/Users.php?f=save, firstname...

PT-2022-20355

Name of the Vulnerable Software and Affected Versions Covid-19 Travel Pass Management System version 1.0 Description The issue is related to Cross Site Scripting XSS in the Covid-19 Travel Pass Management System. The vulnerability can be exploited via the /ctpms/classes/Users.php?f=save API...

PT-2022-20352

Name of the Vulnerable Software and Affected Versions Covid-19 Travel Pass Management System version 1.0 Description The Covid-19 Travel Pass Management System is affected by a SQL Injection issue. This issue can be exploited via the /ctpms/classes/Master.php?f=update application status API...

PT-2022-20125

Name of the Vulnerable Software and Affected Versions Automotive Shop Management System version 1.0 Description The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the API endpoint "/asms/classes/Master.php?f=save product" using the name variable. Recommendations...

PT-2022-20128

Name of the Vulnerable Software and Affected Versions Water-billing-management-system version 1.0 Description The issue concerns SQL Injection via the "/wbms/classes/Master.php?f=delete client" API endpoint, specifically affecting the id variable. This allows for potential manipulation of databas...

CVE-2022-30456: Improper Neutralization of Input During Web Page Generation

Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting XSS via /bcms/classes/Master.php?f=savecourtrental...

CVE-2022-30842: Improper Neutralization of Input During Web Page Generation

Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting XSS via /ctpms/classes/Users.php?f=save, firstname...

PT-2022-20129

Name of the Vulnerable Software and Affected Versions Water-billing-management-system version 1.0 Description The issue is related to Cross Site Scripting XSS that can be exploited via the /wbms/classes/Users.php API endpoint, specifically when the firstname variable is used with the f=save...

PT-2022-20123

Name of the Vulnerable Software and Affected Versions Badminton Center Management System version 1.0 Description The issue is related to Cross Site Scripting XSS via the "/bcms/classes/Master.php?f=save court rental" API endpoint. This allows for potential malicious script injection. No informati...

CVE-2022-30838: Improper Neutralization of Special Elements used in an SQL Command

Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=updateapplicationstatus...

PT-2022-19329

Name of the Vulnerable Software and Affected Versions Online Sports Complex Booking System version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /scbs/classes/Users.php?f=delete client API endpoint. The estimated number of potentially affected devic...

CVE-2022-29652: Improper Neutralization of Special Elements used in an SQL Command

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=saveclient...

PT-2022-19528

Name of the Vulnerable Software and Affected Versions Online Sports Complex Booking System version 1.0 Description The issue concerns SQL Injection via the "/classes/master.php?f=delete Facility" endpoint. This allows for potential manipulation of database queries. No information is provided abou...

CVE-2022-29304: Improper Neutralization of Special Elements used in an SQL Command

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete Facility...

CVE-2022-28962: Improper Neutralization of Special Elements used in an SQL Command

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=deleteclient...

jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based o...