CVE-2023-3705

CVE-2023-3705 affects CP-Plus NVR and is caused by improper input handling in the web-based management interface. An unauthenticated remote attacker can send specially crafted HTTP requests to the vulnerable device, potentially exposing sensitive information. The vulnerability is rated HIGH (CVSS...

CVE-2023-3522

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 License Portal System allows SQL Injection. This issue affects License Portal System: before 1.48...

PT-2023-25606

Name of the Vulnerable Software and Affected Versions Digital Ant E-Commerce Software versions prior to 11 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker c...

CVE-2023-2853

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Softmed SelfPatron allows Reflected XSS. This issue affects SelfPatron : before 2.0...

Medium: curl

Issue Overview: The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and "telnet options" for the server negotiation. Due to lack of proper input scrubbing and without it being the...

Faturamatik Bircard SQL注入漏洞

Faturamatik Bircard is a computing e-money and payment center application from Faturamatik Turkey. An SQL injection vulnerability exists in Faturamatik Bircard versions prior to 23.04.05, which stems from improper neutralization of special elements, which can lead to SQL injection...

CVE-2022-43952

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiADC version 7.1.1 and below, version 7.0.3 and below, version 6.2.5 and below may allow an authenticated attacker to perform a cross-site scripting attack via crafted HTTP requests...

AsKoc Energy Web Report System SQL注入漏洞

AsKoc Energy Web Report System is a website of AsKoc Inc. A security vulnerability exists in AsKoc Energy Web Report System versions prior to 23.03.10 that stems from an improper neutralization of a particular element used and a SQL injection vulnerability...

CVE-2022-47171

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin = 1.1 versions...

Saysis Starcities SQL注入漏洞

Saysis Starcities is an application from Saysis, Inc. A security vulnerability exists in Saysis Starcities that stems from imperfect handling of user input data prior to splicing SQL statements, which could lead to an SQL injection vulnerability...

The vulnerability of D-Link DCS-930L Wi-Fi cameras lies in the lack of measures taken to neutralize special elements used in the operating system’s command structure. This allows intruders to execute arbitrary commands.

The vulnerability of D-Link DCS series Wi-Fi cameras exists due to the lack of measures taken to neutralize special elements used in the operating system’s command structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2023-16379

Name of the Vulnerable Software and Affected Versions ASOS Information Technologies Book Cites versions prior to 23.01.05 Description The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This means an attacker could potentiall...

Glox Technology Useroam Hotspot SQL注入漏洞

Glox Technology Useroam Hotspot is a hotspot system from Glox Technology. Glox Technology Useroam Hotspot suffers from a SQL injection vulnerability that stems from an unsatisfactory neutralization of the particular element used, resulting in SQL injection...

OpenCats 跨站脚本漏洞

steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in OpenCats version 0.9.6 that stems from improper input neutralization and can be exploited by an attacker to steal...

SUSE CVE-2023-0566

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in froxlor/froxlor prior to 2.0.10...

Artica PFMS Pandora FMS 跨站脚本漏洞

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica PFMS Pandora FMS v765, which stems from improper neutralization of user input. A...

Grup Arge Energy and Control Systems SmartPower Energy Management System 跨站脚本漏洞

Grup Arge Energy and Control Systems SmartPower Energy Management System is a web-based system from Grup Arge Energy and Control Systems developed specifically to improve energy efficiency in organizations. A cross-site scripting vulnerability exists in Grup Arge Energy and Control Systems...

Grup Arge Energy and Control Systems SmartPower Energy Management System SQL注入漏洞

Grup Arge Energy and Control Systems SmartPower Energy Management System is a web-based system from Grup Arge Energy and Control Systems developed specifically to improve energy efficiency in organizations. A security vulnerability exists in Grup Arge Energy and Control Systems SmartPower Energy...

UBUNTU-CVE-2022-4092

An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input...

window-control 安全漏洞

window-control is a package from Bruno Robert's personal developer. It is designed to perform tasks similar to robot.js without mouse control, but without compiling external C++ code. A security vulnerability exists in window-control versions prior to 1.4.5, which stems from incorrect input and i...