Oracle MySQL 输入验证错误漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. An input validation error vulnerability exists in Oracle MySQL, which can be exploited to take over the MySQL Cluster...

The vulnerability of the database of the Mendix software platform for deploying and testing software applications allows a perpetrator to disclose protected information.

The vulnerability of the software platform for deploying and testing Mendix application programs is related to configuration errors. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

U.S. Dept Of Defense: SQL Injection at https://████████.asp (█████████) [selMajcom] [HtUS]

Summary: SQL injection SQLi is a vulnerability in which an application accepts input into an SQL statement and treats this input as part of the statement. Typically, SQLi allows a malicious attacker to view, modify or delete data that should not be able to be retrieved. An SQLi vulnerability was...

CVE-2021-44915

Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category...

Vulnerability fixed in IBM Db2

IBM has fixed a vulnerability in Db2. The vulnerability allows a malicious person to gain access to sensitive data. IBM has released updates to fix the vulnerability in Db2. For more information, see: https://www.ibm.com/support/pages/node/6597993...

CVE-2022-32340

Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=patients/viewpatient&id=...

CVE-2022-31447

An XML external entity XXE injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file...

Fast Food Ordering System SQL注入漏洞

Fast Food Ordering System is a fast food ordering system from Carlo Montero's personal developer. version 1.0 of Fast Food Ordering System is vulnerable to SQL injection, which originates from /ffos/admin/menus/managemenu.php?id= The page lacks validation for external input SQL statements, which...

Rescue Dispatch Management System SQL注入漏洞（CNVD-2022-53916）

Rescue Dispatch Management System is a rescue dispatch management system developed by Carlo Montero. v1.0 of Rescue Dispatch Management System is vulnerable to SQL injection, which originates from /rdms/admin/ incidents/viewincident.php?id=The page lacks validation for external input SQL...

DHIS2 SQL Injection Vulnerability

DHIS2 is an information system for data capture, management, validation, analysis, and visualization. DHIS2 is vulnerable to SQL injection, which can be exploited by attackers to read, edit, and delete data in the DHIS2 instance database...

Complete Online Job Search System SQL注入漏洞

Complete Online Job Search System is an online job search system. SQL injection vulnerability exists in Complete Online Job Search System, which originates from /eris/admin/applicants/index.php?view=view&id= The page lacks validation for external input SQL statements. An attacker could use this...

phpABook SQL注入漏洞

phpABook is a simple address/contact management system using PHP and MySQL. phpABook version 0.9i is vulnerable to a SQL injection vulnerability caused by a failure to properly clean up the "authuser" parameter in the index.php script. An attacker could use this vulnerability to execute illegal S...

The vulnerability of the FortiSIEM security management system’s database allows a attacker to gain access to the device’s database.

The vulnerability of the FortiSIEM security management system is related to the use of pre-installed credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the device’s database...

Froxlor SQL injection vulnerability

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name...

Liferay Portal and Liferay DXP Stores User Passwords in Cleartext

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the...

Liferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortlet

In LifeRay Portal CE 7.1.0 through 7.2.1, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will...

Nextcloud: Ownership check missing when updating or deleting attachments

Summary: Ownership check is missing for attachments. Steps To Reproduce: 1. Open mail app 2. Compose a new message 3. Attach some file 4. Send message 5. Copy the xhr request and modify the attachment ids 6. See that localmessageid is changed for a different user When you compose a message and pu...

CVE-2021-42644

cmseasy V7.7.520211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file config / configdatabase can be read through this vulnerability...

Arbitrary Code Injection

publifycore is vulnerable to arbitrary code injection. The vulnerability exists in htmlpostprocess in feedback.rb because the application doesn't filter the user comments which allows an attacker to inject html codes in the database...

The vulnerability of the USERDBDomains.Domainname function in the cgi-bin/platform.cgi file of the NETGEAR ProSafe SSL VPN network interface card’s software allows a hacker to execute arbitrary SQL queries.

The vulnerability of the USERDBDomains.Domainname function in the cgi-bin/platform.cgi file of the NETGEAR ProSafe SSL VPN network interface card’s software is related to the possibility of executing commands. Exploiting this vulnerability could allow a malicious actor to execute arbitrary SQL...