Sourcecodester Simple Client Management System SQL注入漏洞（CNVD-2022-35540）

Sourcecodester Simple Client Management System is a simple web-based application that provides an online platform to manage company customer invoices. sourcecodester Simple Client Management System is vulnerable to SQL injection vulnerability, which stems from the application's lack of validation...

SQL Injection Vulnerability in Road Passenger Transportation Ticketing System of Centillion Times Technology Group Co.

Centillion Times Technology Group Co., Ltd. has become China's largest Internet + public travel comprehensive service operation platform, and has built and operated local provincial road passenger transportation network ticketing systems for many provinces, municipalities and autonomous regions. ...

Design/Logic Flaw

XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database...

Possible SQL injection in widget field value

Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...

What Does an Internal Attack Resulting in a Data Breach Look Like in Today’s Threat Landscape?

In my last blog, I explained why taking the approach of setting up perimeter defenses, restricting data access, patching vulnerabilities, applying sensors to data movement, and encrypting data is no longer solely effective at stopping data breaches in today’s threat landscape. I also discussed th...

CVE-2021-44866

An issue was discovered in Online-Movie-Ticket-Booking-System 1.0. The file about.php does not perform input validation on the 'id' paramter. An attacker can append SQL queries to the input to extract sensitive information from the database...

Oracle MySQL Cluster Buffer Overflow Vulnerability (CNVD-2022-18211)

MySQL Cluster is a write-scalable, real-time, ACID-compliant transactional database designed to guarantee 99.999% availability. A buffer overflow vulnerability exists in Oracle MySQL Cluster, which can be exploited by an attacker to execute code in the context of a service account...

CVE-2022-23857

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table which contains sensitive information such as the users...

CVE-2022-23129

CVE-2022-23129 affects Mitsubishi Electric MC Works64 and ICONICS GENESIS64 where exporting GridWorX Server configuration to CSV saves authentication information in plaintext. Affected products: ICONICS GENESIS64 (versions 10.90 to 10.97) and MC Works64 (prior to 4.04E / 10.95.210.01). Root cause...

Saraban SQL Injection Vulnerability

Softvibe Saraban is a document management system from Softvibe Thailand. It is used for transferring files and notifications to reduce unnecessary duplication. softvibe Saraban has a SQL injection vulnerability in v1.1, which can be exploited by attackers to execute illegal SQL commands to steal...

Oracle MySQL 输入验证错误漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. An input validation error vulnerability exists in MySQL Cluster, which stems from incorrect input validation by the Cluster: General component in MyS...

3 Data Source Coverage Capabilities You Need from Your Database Security Solution

When Henry Ford, the de-facto inventor of mass production, was asked during a production meeting in 1909 in which colors his Model T automobile would be available to consumers, Ford - a notorious stickler for keeping costs to the bare minimum - offered almost no optional extras and that included...

CVE-2021-46166

CVE-2021-46166 affects Zoho ManageEngine Desktop Central prior to 10.0.662. The vulnerability allows authenticated users to disclose sensitive information from the database by visiting the Reports page. The available documents confirm an information-disclosure impact but do not provide exploit ve...

WordPress WP_Query SQL Injection Vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress has a SQL injection vulnerability in versions prior to 5.8.3, which stems from the lack of validation of externally...

Projectworlds Hospital Management System SQL Injection Vulnerability (CNVD-2022-01377)

Projectworlds Hospital Management System is a hospital management system from Projectworlds Austria.Projectworlds Hospital Management System is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

Imperva Snapshot™ Scan: What You Can Find in the Report

Imperva Snapshot is a free AWS RDS security assessment tool. You can use this tool to gain in-depth visibility into your data and get a deep understanding about what data resides in your RDS and where your RDS database security gaps are. Acquiring this intelligence is a key element and critical...

taocms SQL Injection Vulnerability (CNVD-2021-101663)

Taocms is a micro Cms Content Management System in China.Taocms has a SQL injection vulnerability in version 3.0.2, which stems from the application's lack of validation of externally entered SQL statements. An attacker could use this vulnerability to execute illegal SQL commands to steal sensiti...

CVE-2021-41843

CVE-2021-41843 describes an authenticated SQL injection in the OpenEMR calendar search (calendar/index.php?module=PostCalendar&func=search). The vulnerability resides in the provider_id parameter, allowing an authenticated attacker to read data from all database tables. Affected product/version: ...

McAfee Database Security Improper Access Control Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of McAfee Database Security. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2021-40861

A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution IWD 9.0.017.07 allows an attacker to execute arbitrary SQL queries via the value attribute, with which all data in the database can be extracted and OS command execution is possible depending on the...