GHSA-7PR3-34RG-G53M Magento Unrestricted file upload vulnerability

An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database to transform uploaded JPEG file into a PHP file...

PT-2022-15416

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.0 through 21.0.2 Description The issue allows a remote attacker to send specially crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end...

Sql injection

Delta Electronics DIAEnergie All versions prior to 1.8.02.004 has a blind SQL injection vulnerability exists in DIAEslogHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands...

CVE-2022-1378

Delta Electronics DIAEnergie All versions prior to 1.8.02.004 has a blind SQL injection vulnerability exists in DIAEpgHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands...

Attendance and Payroll System SQL注入漏洞（CNVD-2022-33136）

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system from oretnom23 individual developers. sql injection vulnerability exists in Attendance and Payroll System, which can be exploited by remote attackers to submit special SQL requests to manipulate database, whic...

CVE-2022-23972 ASUS RT-AX56U - SQL Injection

ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database...

CVE-2022-26065 Delta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisData

Delta Electronics DIAEnergie All versions prior to 1.8.02.004 has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands...

CVE-2022-0923 Delta Electronics DIAEnergie SQL Injection in HandlerDialog_KID.ashx

Delta Electronics DIAEnergie All versions prior to 1.8.02.004 has a blind SQL injection vulnerability that exists in HandlerDialogKID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-27441)

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

eliteCMS /admin/edit_user.php SQL Injection Vulnerability

eliteCMS is a popular content management system. A SQL injection vulnerability exists in eliteCMS /admin/edituser.php, which can be exploited by remote attackers to submit a special SQL request to manipulate the database, obtain sensitive information or execute arbitrary code...

eliteCMS /admin/functions/functions.php SQL Injection Vulnerability

eliteCMS is a popular content management system. A SQL injection vulnerability exists in eliteCMS /admin/functions/functions.php, which can be exploited by remote attackers to submit a special SQL request to manipulate the database, obtain sensitive information or execute arbitrary code...

Elite Graphix Elite Cms SQL注入漏洞

eliteCMS is a popular content management system. A SQL injection vulnerability exists in eliteCMS /admin/edituser.php, which can be exploited by remote attackers to submit a special SQL request to manipulate the database, obtain sensitive information or execute arbitrary code...

PT-2022-11417

Name of the Vulnerable Software and Affected Versions Sourcecodester Simple Membership System version v1 Description The issue allows attackers to execute arbitrary SQL commands via the username and password parameters. This enables attackers to manipulate the database, potentially leading to...

PT-2022-11271

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Leave Management System version v1 Description The issue allows attackers to execute arbitrary SQL commands via the username parameter to the "/leave system/classes/Login.php" API endpoint. This enables attackers to...

PT-2022-8881

Name of the Vulnerable Software and Affected Versions cscms version 4.1 Description The issue allows for SQL injection via the js del function. This enables potential attackers to inject malicious SQL code, which could lead to unauthorized access or manipulation of database content. Recommendatio...

PT-2022-8882

Name of the Vulnerable Software and Affected Versions cscms version 4.1 Description The issue allows for SQL injection via the page del function. This could potentially lead to unauthorized access or manipulation of database content. Recommendations For cscms version 4.1, consider disabling the...

PT-2021-24055

Name of the Vulnerable Software and Affected Versions: MOTP system affected versions not specified Description: The issue concerns insufficient validation for user input in a specific function parameter of the MOTP system. This allows an attacker within the local area network to perform a SQL...

Aanderaa GeoView SQL注入漏洞

Aanderaa GeoView is a web-based solution for displaying environmental data. Aanderaa GeoView suffers from a SQL injection vulnerability that can be exploited by an attacker to manipulate the database server...

SQL Injection in forkcms/forkcms

Description When deleting submissions which belong to a formular made with module FormBuilder, the parameter id is vulnerable for SQL injection. Proof of Concept - Call the URL...

CVE-2021-38295 Privilege escalation vulnerability when using HTML attachments

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will b...