GHSA-VJMR-6PMM-RPRF Dataease v1.11.1 SQL Injection via parameter dataSourceId

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. Version 1.11.2 contains a fix...

CVE-2017-20139

A vulnerability was found in Itech Movie Portal Script 7.36. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /shownews.php. The manipulation of the argument id with the input AND SELECT 1222 FROMSELECT COUNT,CONCAT0x71786b7a71,SELECT...

CVE-2017-20143

A vulnerability, which was classified as critical, has been found in Itech Movie Portal Script 7.36. This issue affects some unknown processing of the file /film-rating.php. The manipulation of the argument v leads to sql injection Error. The attack may be initiated remotely. The exploit has been...

CVE-2022-2137

The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose information...

SonicWALL Analytics On-Prem SQL注入漏洞

SonicWALL Analytics is a high-performance management and reporting engine for the Web from SonicWALL, Inc. A SQL injection vulnerability exists in SonicWALL Analytics On-Prem 2.5.0.3-2520 and prior versions, which stems from incorrect neutralization of special elements used in SQL commands...

CVE-2022-34042

Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hiddenid parameter at /pages/household/household.php...

CVE-2022-24691

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based...

DSK DSKNet SQL注入漏洞

DSK DSKNet is a data interaction program from DSK Japan. Their time and attendance data can be accessed interactively from any site connected to your network. A security vulnerability exists in DSK DSKNet 2.16.136.0 and 2.17.136.5, which originates from a SQL injection vulnerability in PresAbs.ph...

LogoStore SQL注入漏洞

LogoStore is an online store from LogoStore Inc. in the United States. A security vulnerability exists in LogoStore that stems from an unknown function in the affected file /LogoStore/search.php. The function can lead to SQL injection, potentially launching an attack from a remote location. It is...

Clinics Patient Management System SQL注入漏洞

Clinics Patient Management System is a clinic patient management system. A SQL injection vulnerability exists in Clinics Patient Management System version 2.0, which originates from a parameter username that can be exploited to execute illegal SQL commands...

CVE-2022-1057

The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

CVE-2022-32056

Online Accreditation Management v1.0 was discovered to contain a SQL injection vulnerability via the USERNAME parameter at process.php...

Gallagher Command Centre Server SQL注入漏洞

Gallagher Command Center Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Centre Server that originates from an SQL injection attack via a Windows registry setting in the date field ...

CVE-2022-32311

Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/viewstock.php...

CVE-2022-34972

So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the attvalueid , manuvalueid , optvalueid , and subcatevalueid parameters at /index.php?route=extension/module/sofiltershopby/filterdata...

CVE-2022-34877

SQL Injection vulnerability in AST Agent Time Sheet interface /vicidial/ASTagenttimesheet.php of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailabl...

PT-2022-20959 · Unknown · Newsletter Module

Name of the Vulnerable Software and Affected Versions: Newsletter Module versions 3.x Description: The issue is related to a SQL injection vulnerability. It can be exploited via the zemez newsletter email parameter at the "/index.php" API endpoint. Recommendations: For Newsletter Module version...

VICIdial SQL注入漏洞

VICIdial is a software suite from VICIdial, Inc. designed to interact with the Asterisk open source Pbx telephony system as a complete inbound/outbound contact center suite with inbound email support. A SQL injection vulnerability exists in VICIdial versions prior to 2.14b0.5, which stems from...

CVE-2022-33171

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that...

UBUNTU-CVE-2022-34265

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...