CVE-2024-11167

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user...

LibreChat 访问控制错误漏洞

LibreChat is an enhanced ChatGPT clone. An Access Control Error vulnerability exists in versions of LibreChat prior to 0.7.6, which stems from the groupid parameter not verifying that the prompt ID provided belongs to the current user, and can be exploited by an attacker to cause the deletion of...

CVE-2024-11167: Authorization Bypass Through User-Controlled Key

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user...

BeiJing Seeyon Internet FE Collaborative Office Platform 安全漏洞

BeiJing Seeyon Internet FE Collaborative Office Platform is a collaborative office platform software from BeiJing Seeyon Internet BeiJing Seeyon Internet in Beijing, China, which is used for collaborative office work and information sharing within an organization. A security vulnerability exists ...

PT-2025-9928

Name of the Vulnerable Software and Affected Versions Seeyon Zhiyuan Interconnect FE Collaborative Office Platform versions up to 20250224 Description A critical issue affects some unknown functionality of the file /security/addUser.jsp, where the manipulation of the groupId argument leads to SQL...

CVE-2025-2030: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform up to 20250224. It has been rated as critical. Affected by this issue is some unknown functionality of the file /security/addUser.jsp. The manipulation of the argument groupId leads to sql injection. The...

PT-2024-27187

Name of the Vulnerable Software and Affected Versions Xiamen Four-Faith RMP Router Management Platform version 5.2.2 Description A critical issue has been found in the Xiamen Four-Faith RMP Router Management Platform. The problem affects the file...

Xiamen Four-Faith RMP Router Management Platform SQL注入漏洞

Xiamen Four-Faith RMP Router Management Platform is an online chat system from Xiamen Four-Faith, China. A SQL injection vulnerability exists in Xiamen Four-Faith RMP Router Management Platform version 5.2.2, which stems from an incorrect operation of the parameter groupId that can lead to sql...

CVE-2024-3688: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Xiamen Four-Faith RMP Router Management Platform 5.2.2. It has been declared as critical. This vulnerability affects unknown code of the file /Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=. The manipulation of the argument groupId leads to sql...

Netentsec NS-ASG Application Security Gateway SQL注入漏洞

NetentSec NS-ASG Application Security Gateway is an application security gateway from China NetentSec. A SQL injection vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which originates from a SQL injection vulnerability in the parameter GroupId in the file...

PT-2024-25985 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical vulnerability has been found in the Netentsec NS-ASG Application Security Gateway. This issue affects an unknown part of the file /admin/config...

CVE-2024-3457: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/configISCGroupNoCache.php. The manipulation of the argument GroupId leads to sql injection. It is possible to initiate the attack remotely. T...

PT-2024-2872

Name of the Vulnerable Software and Affected Versions Netentsec NS-ASG Application Security Gateway version 6.3 Description A critical issue affects some unknown functionality of the file /admin/config Anticrack.php, where the manipulation of the GroupId argument leads to SQL injection. This can ...

Netentsec NS-ASG Application Security Gateway SQL注入漏洞

NetentSec NS-ASG Application Security Gateway is an application security gateway from China NetentSec. A SQL injection vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which originates from a SQL injection vulnerability in the parameter GroupId in the file...

CVE-2024-3456: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/configAnticrack.php. The manipulation of the argument GroupId leads to sql injection. The attack may be launched...

CVE-2024-28714

SQL Injection vulnerability in CRMEBJava e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter...

Zhongbang CRMEB 安全漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang in Xi'an, China. A security vulnerability exists in CRMEB Java e-commerce system version v.1.3.4. An attacker can exploit this vulnerability to execute arbitrary code via the groupid parameter...

CVE-2024-28714

SQL Injection vulnerability in CRMEBJava e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter...

CVE-2024-28714: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in CRMEBJava e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter...

PT-2024-22534

Name of the Vulnerable Software and Affected Versions CRMEB Java e-commerce system version 1.3.4 Description The issue allows an attacker to execute arbitrary code via the groupid parameter, potentially leading to unauthorized access and data manipulation. Recommendations For CRMEB Java e-commerc...