SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0

Summary A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, may allow an unauthenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application ...

CVE-2023-5019

A vulnerability classified as critical was found in Tongda OA. This vulnerability affects unknown code of the file general/hr/manage/staffreinstatement/delete.php. The manipulation of the argument REINSTATEMENTID leads to sql injection. The attack can be initiated remotely. The exploit has been...

mccms SQL Injection Vulnerability

mccms diffuse city CMS is a rapid website building system for individual developers of China Smokey River South chshcms. The mccms 2.6 version exists SQL injection vulnerability, the vulnerability stems from allowing attackers through the file copyright/46/finish/1/list/1 SQL injection...

Food Ordering website SQL Injection Vulnerability

Food Ordering website is a food ordering website. A SQL injection vulnerability exists in Food Ordering Website version 1.0, which stems from some unknown processing in categoryfood.php that causes sql injection via the parameter id...

lmxcms SQL Injection Vulnerability

lmxcms dream cms is a website builder from China Dream Cms lmxcms company. SQL injection vulnerability exists in lmxcms version before 1.41, the vulnerability stems from the existence of an unknown function in the file admin.php, which leads to sql injection via the parameter lid...

CVE-2023-4670

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Innosa Probbys allows SQL Injection. This issue affects Probbys: before 2...

CVE-2023-4830

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tura Signalix allows SQL Injection. This issue affects Signalix: 7T0228...

CVE-2023-39642

Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display...

CVE-2023-40958

A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the query parameter in models/baseclient.py component...

PT-2023-27720 · Didotech Srl · Didotech Srl Engineering & Lifecycle Management +1

Name of the Vulnerable Software and Affected Versions: Didotech srl Engineering & Lifecycle Management aka pdm versions 14.0 through 16.0 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary code via the request parameter in the models/base client.py...

PrestaShop LeoTheme leoblog SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image zoom and other features. A security vulnerability exists in PrestaShop LeoTheme leoblog version v3.1.2, which stems...

Aceka Company Management SQL Injection Vulnerability

Aceka Company Management is a company management software from Aceka. Aceka Company Management versions prior to 3072 are vulnerable to a SQL injection vulnerability that stems from the presence of a SQL injection vulnerability...

PT-2023-27047 · Unknown · Bl Modules Xmlfeeds

Name of the Vulnerable Software and Affected Versions: Bl Modules xmlfeeds versions prior to 3.9.8 Description: The issue is related to a SQL injection vulnerability. It affects the component SearchApiXml::Xmlfeeds. Recommendations: For versions prior to 3.9.8, update to version 3.9.8 or later to...

WordPress plugin Slimstat Analytics SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exists i...

iCMS SQL Injection Vulnerability

iCMS is a software application. An efficient and simple content management system built with PHP and MySQL. A SQL injection vulnerability exists in iCMS versions prior to 2.16.1, which stems from susceptibility to SQL injection attacks...

Vulnerabilities fixed in Nagios XI

Vulnerabilities have been fixed in Nagios XI. A malicious party can exploit the vulnerabilities to use SQL injection to manipulate data manipulate data or gain access to sensitive data within Nagios, or to perform a Cross-Site-Scripting XSS attack. Such an attack can lead to execution of arbitrar...

Schoolmate SQL Injection Vulnerability

Schoolmate is a PHP/MySQL solution for elementary, middle and high schools from mrmunkey22 Individual Developer. A security vulnerability exists in Schoolmate version 1.3, which was discovered to contain an SQL injection vulnerability via the $username variable of SESSION in ValidateLogin.php...

CVE-2023-4872

A vulnerability, which was classified as critical, has been found in SourceCodester Contact Manager App 1.0. This issue affects some unknown processing of the file add.php. The manipulation of the argument contact/contactName leads to sql injection. The attack may be initiated remotely. The explo...

CVE-2023-4866

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file booking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been...

Online Tours & Travels Management System SQL Injection Vulnerability

Online Tours & Travels Management System is an online travel management system by Mayuri K. Individual developer. A SQL injection vulnerability exists in Online Tours & Travels Management System, which can be exploited via the id parameter of the exec function on the booking.php page...