1126 matches found
Design/Logic Flaw
When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...
CVE-2022-37773
An authenticated SQL Injection vulnerability in the statistics page /statistics/retrieve of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases...
CVE-2022-37773
An authenticated SQL Injection vulnerability in the statistics page /statistics/retrieve of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases...
CVE-2022-37773
Maarch RM 2.8 is affected by an authenticated SQL Injection on the statistics page, specifically /statistics/retrieve, via the filter parameter. The vulnerability enables complete disclosure of all databases. Several connected sources confirm the issue but do not provide a confirmed fix version; ...
CVE-2022-37773
An authenticated SQL Injection vulnerability in the statistics page /statistics/retrieve of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases...
PT-2022-24063 · Maarch Rm · Maarch Rm
Name of the Vulnerable Software and Affected Versions: Maarch RM version 2.8 Description: The issue is related to an authenticated SQL Injection vulnerability in the statistics page, specifically at the "/statistics/retrieve" API endpoint, via the filter parameter. This vulnerability allows for t...
CVE-2022-42473
A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose information via logging into the database using a privileged account without a password...
CVE-2022-27549 HCL Launch could disclose sensitive database information to a local user in plain text.
HCL Launch may store certain data for recurring activities in a plain text format...
CVE-2021-43969
The login.jsp page of Quicklert for Digium 10.0.0 1043 is affected by both Blind SQL Injection with Out-of-Band Interaction DNS and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database up to and including the administrative accounts' login IDs and...
Sql injection
The login.jsp page of Quicklert for Digium 10.0.0 1043 is affected by both Blind SQL Injection with Out-of-Band Interaction DNS and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database up to and including the administrative accounts' login IDs and...
CVE-2021-43969
The login.jsp page of Quicklert for Digium 10.0.0 1043 is affected by both Blind SQL Injection with Out-of-Band Interaction DNS and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database up to and including the administrative accounts' login IDs and...
Exponent CMS 2.6 - Multiple Vulnerabilities
Exploit Title: Exponent CMS 2.6 - Multiple Vulnerabilities Exploit Author: heinjame Exploit Author: picaroo Vendor Homepage: https://www.exponentcms.org/ Version: http://127.0.0.1:8082/expcms/text/edit/id/id/src/@footer Title, Text Block Payload = " Database credential are disclosed in response P...
Exponent CMS 2.6 - Multiple Vulnerabilities
Exploit Title: Exponent CMS 2.6 - Multiple Vulnerabilities Exploit Author: heinjame Date: 22/10/2021 Exploit Author: picaroo Vendor Homepage: https://www.exponentcms.org/ Version: http://127.0.0.1:8082/expcms/text/edit/id/id/src/@footer Title, Text Block Payload = " Database credential are...
CVE-2021-42760
A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests...
CVE-2021-36184
A improper neutralization of Special Elements used in an SQL Command 'SQL Injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosure device, users and database information via crafted HTTP requests...
Fortinet FortiWLC SQL注入漏洞
Fortinet FortiWLC is a wireless LAN controller from Fortinet. A security vulnerability in Fortinet FortiWLC version 8.6.1 and below can be exploited by an attacker to disclose device, user, and database information via a crafted HTTP request...
Elasticsearch ECE 7.13.3 Database Disclosure
Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump Date: 2021-07-21 Exploit Author: Joan Martinez @magichk Vendor Homepage: https://www.elastic.co/ Software Link: https://www.elastic.co/ Version: = 7.10.0 to = 7.13.3 Tested on: Elastic ECE Cloud CVE : CVE-2021-22146 Reference:...
OpenClinic GA Command Injection Vulnerability
OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. A command injection vulnerability exists in OpenClinic GA version 5.173.3, which can be exploited by an attacker to...
OpenClinic GA 操作系统命令注入漏洞
OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. A command injection vulnerability exists in OpenClinic GA version 5.173.3, which can be exploited by an attacker to...