Code injection

SpringbootCMS 1.0 foreground message can be embedded malicious code saved in the database. When users browse the comments, these malicious codes embedded in the HTML will be executed, and the user's browser will be controlled by the attacker, so as to achieve the special purpose of the attacker,...

CVE-2023-40046 WS_FTP Server SQL Injection via Administrative Interface

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WSFTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements...

CVE-2023-40043 MOVEit Transfer System Administrator SQL Injection

In Progress MOVEit Transfer versions released before 2021.1.8 13.1.8, 2022.0.8 14.0.8, 2022.1.9 14.1.9, 2023.0.6 15.0.6, a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the...

CVE-2023-4092 SQL injection vulnerability in Fujitsu Arconte Áurea

SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to read sensitive data from the database, modify data insert/update/delete, perform database administration operations and, in some cases, execute commands on the...

The vulnerability of the JDBC client driver of the IBM DB2 database management system allows a perpetrator to execute arbitrary code.

The vulnerability of the JDBC client driver of the IBM DB2 database management system is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the MariaDB database management system lies in the improper processing of condition transfers from HAVING to WHEREE, which allows attackers to trigger service failures.

The vulnerability of the MariaDB database management system is related to the incorrect processing of condition transfers from HAVING to WHEREE. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2023-40944

Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at \header.php...

CVE-2023-40944

Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at \header.php...

CVE-2023-40944

Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at \header.php...

CVE-2023-4485

ARDEREG ​Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, th...

Sql injection

ARDEREG ?Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, th...

Design/Logic Flaw

User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the password recovery function to enumerate all users in the database...

The vulnerability of the sqlite3ExprCodeTarget function in the database management system SQLite, which allows a hacker to cause a service failure

The vulnerability of the sqlite3ExprCodeTarget function in the SQLite database management system is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

Sql injection

IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 257614...

CVE-2023-37438

CVE-2023-37438 involves multiple SQL injection vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator. An authenticated remote attacker could exploit these flaws to obtain and modify sensitive data in the underlying database, potentially leading to exposure and c...

CVE-2023-39939

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M MySQL version and LuxCal Web Calendar prior to 5.2.3L SQLite version allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it...

The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system lies in the lack of protection for the SQL query structure, allowing attackers to execute arbitrary SQL queries against the database server.

The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database server remotely...

Sql injection

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This...

Sentry : Database Open Access Vulnerability

Last Modified Date Aug 17, 2023 3:23:30 PM...

Password Plaintext Storage

The application stored a password in a database in plaintext format. Storing user passwords in a database in plaintext is a security vulnerability that can have serious consequences. If an attacker is able to gain access to the database, they will be able to see all of the user passwords in plain...