13443 matches found
PT-2022-20690
Name of the Vulnerable Software and Affected Versions Online Ordering System By janobe version 2.3.2 Description The issue is related to SQL Injection. It affects the /ordering/admin/products/index.php?view=edit&id= API endpoint, where the id parameter is vulnerable. Recommendations For version...
CVE-2022-31338: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=...
CVE-2022-31337: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/category/index.php?view=edit&id=...
PT-2022-20331
Name of the Vulnerable Software and Affected Versions Simple Bus Ticket Booking System version 1.0 Description The issue concerns SQL Injection, which can be exploited via the "/SimpleBusTicket/index.php" API endpoint. Recommendations For Simple Bus Ticket Booking System version 1.0, update the...
CVE-2022-30817: Improper Neutralization of Special Elements used in an SQL Command
Simple Bus Ticket Booking System 1.0 is vulnerable to SQL Injection via /SimpleBusTicket/index.php...
CVE-2022-31328: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System By janobe 2.3.2 has SQL Injection via /ordering/admin/products/index.php?view=edit&id=...
CVE-2022-31327: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System By janobe 2.3.2 is vulneranle to SQL Injection via /ordering/index.php?q=products&id=...
CVE-2022-30352: Improper Neutralization of Special Elements used in an SQL Command
phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "authuser" parameter in index.php script...
PT-2022-20072
Name of the Vulnerable Software and Affected Versions phpABook version 0.9i Description The issue arises from insufficient sanitization of user-supplied data in the auth user parameter, leading to SQL Injection. This occurs in the index.php script. Recommendations For phpABook version 0.9i,...
NukeViet Cross-Site Request Forgery (CSRF)
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...
GHSA-J4FQ-3FM7-WH5V Magento arbitrary PHP code execution via the productData parameter
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...
Magento arbitrary PHP code execution via the productData parameter
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...
GHSA-G32Q-4FHF-CQ72 ImpressCMS XSS
ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...
CVE-2022-31489: Improper Neutralization of Special Elements used in an SQL Command
Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutiolanguage cookie SQL injection...
PT-2022-20757
Name of the Vulnerable Software and Affected Versions Inout Blockchain AltExchanger version 1.2.1 Description The issue allows for SQL injection in the marketcurrency parameter of the "index.php/coins/update marketboxslider" API endpoint. This could potentially lead to unauthorized access or...
CVE-2022-31488: Improper Neutralization of Special Elements used in an SQL Command
Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/updatemarketboxslider marketcurrency SQL injection...
PT-2022-20758
Name of the Vulnerable Software and Affected Versions Inout Blockchain AltExchanger version 1.2.1 Description The issue allows for SQL injection through the inoutio language cookie in the index.php/home/about endpoint. This can potentially lead to unauthorized access or manipulation of data...
GHSA-V3M8-7H3P-6J5M Dolibarr ERP and CRM SQLi
Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...
