CVE-2021-22854

The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege...

Sql injection

The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege...

CASAP Automated Enrollment SQL Injection Vulnerability

CASAP Automated Enrollment is an automated enrollment system organized by CASAP USA. The purpose of this project is to provide an automated enrollment system for CASAP to streamline the school process and make it more effective, efficient, and easily retrievable. A SQL injection vulnerability...

SQL Injection Vulnerability in Qibo CMS (CNVD-2021-14441)

Qibo CMS system uses the core + plug-in + channel module system architecture, while then combined with visual labeling technology, can be evolved into a variety of corporate, government, education, units, school websites. Qibo CMS whole site system has a SQL injection vulnerability, attackers can...

Format string

An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product...

CVE-2020-10375

CVE-2020-10375 affects New Media Smarty before 9.10. The issue is that passwords are stored in an obfuscated format that can be easily reversed, with the obfuscated values located in the file data.mdb (second column). This is explicitly noted as unrelated to the popular Smarty template engine pro...

CVE-2020-10538

An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute-forced efficiently and should not be used for such purposes. Additionally, since no salt is used, rainbow tables can speed up the attack...

Redfan iOffice Hospital Edition suffers from SQL Injection Vulnerability

hereinafter referred to as: Redfan Technology is a high-tech enterprise held by Guangzhou Shipbuilding International Company Limited, a subsidiary of China State Shipbuilding Corporation CSSC, one of the top ten military industrial groups. Red Sail iOffice Hospital Edition exists SQL injection...

SQL Injection Vulnerability in Firebird Portal Management System

Suzhou Coolman Software Technology Co., Ltd. is a high-tech enterprise of portal software development, which is engaged in the research and development of local portal system in China. Firebird portal management system has a SQL injection vulnerability. Attackers can use the vulnerability to obta...

SQL injection vulnerability in ne***-c***.asp page of website building system of Tianjin Qipeng Technology Development Co.

Tianjin Qipeng Technology Development Co., Ltd. is a professional for enterprises or individuals to provide website design and production, website construction, enterprise official website production, small program development, Baidu keyword promotion and optimization, APP development of a compan...

The vulnerability of the central/executar_login.php component of the Mk-Auth authentication software allows a hacker to execute arbitrary SQL queries against the database.

The vulnerability of the central/executarlogin.php component of the Mk-Auth authentication software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database in the target...

SQL injection vulnerability in songcms backend (CNVD-2021-12740)

SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. SongCMS backend suffers from a sql injection vulnerability. An attacker can exploit this...

SQL injection vulnerability in UF U8-OA in***.jsp file

Founded in 1988, UFIDA is a global provider of advanced cloud services, software, and financial services for enterprises and public organizations. A SQL injection vulnerability exists in the UFIDA U8-OA in.jsp file, which can be exploited by an attacker to obtain sensitive database information...

SQL Injection Vulnerability in Office Fly of Zhejiang Eagle Software Co. Ltd (CNVD-2021-10547)

Ltd. ZheJiang Eagle Soft Co., LTD was established in November 2004, the company adhere to the "focus, professional" business philosophy for enterprises, administrative institutions to provide information technology solutions and software services. The company adheres to the business philosophy of...

SQL Injection Vulnerability in Office Fly of Zhejiang Eagle Software Co. Ltd (CNVD-2021-10545)

Ltd. ZheJiang Eagle Soft Co., LTD was established in November 2004, the company adhere to the "focus, professional" business philosophy for enterprises, administrative institutions to provide information technology solutions and software services. The company adheres to the business philosophy of...

SQL Injection Vulnerability in Surplus Vision HD Intelligent Recording and Broadcasting System

Ltd. NCAST is a high-tech enterprise focusing on product development in the three major fields of multimedia communication, video and audio coding and decoding, and intelligent image processing, as well as excellent Internet services. A SQL injection vulnerability exists in NCAST's HD Intelligent...

Sql injection

IBM Security Guardium 10.6 and 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 191398...

SQL Injection Vulnerability in Cumulus Reports

Cumulus Reports is a free enterprise-grade WEB reporting tool. Cumulus Reports suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Kotto's Fully Intelligent Parking Video Charging System (CNVD-2021-08429)

Xiamen Corto Communication Technology Co., Ltd Corto Parking is a professional intelligent parking value operator, providing intelligent parking services to customers. A SQL injection vulnerability exists in KOTO's fully intelligent parking video charging system. An attacker can exploit the...

SQL Injection Vulnerability in T_Pa***_Su***.aspx Page of KTO's Fully Intelligent Parking Video Charging System

Xiamen Corto Communication Technology Co., Ltd Corto Parking is a professional intelligent parking value operator, providing intelligent parking services to customers. A SQL injection vulnerability exists in the TPaSu.aspx page of KOTO's fully intelligent parking video charging system. An attacke...