Sql injection

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the inputid POST parameter in index.php...

CVE-2021-37293

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

CVE-2021-37291: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the inputid POST parameter in index.php...

CVE-2021-37293: Improper Limitation of a Pathname to a Restricted Directory

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

PT-2022-10648

Name of the Vulnerable Software and Affected Versions KevinLAB Inc Building Energy Management System 4ST BEMS version 1.0.0 Description A Directory Traversal issue exists via the page GET parameter in index.php. This allows for potential unauthorized access to sensitive files and directories...

PT-2022-10646

Name of the Vulnerable Software and Affected Versions KevinLAB Inc Building Energy Management System 4ST BEMS version 1.0.0 Description An SQL Injection issue exists in the system, specifically through the input id POST parameter in the "index.php" endpoint. This allows for potential exploitation...

Cross site request forgery (csrf)

qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...

CVE-2022-26180

The CVE-2022-26180 describes a CSRF vulnerability in qdPM 9.2 that can be exploited via the index.php/myAccount/update URI due to lack of CSRF token validation. Impact is high (C/H/I/A = High) with CVSS 3.1 base score 8.8; basic user interaction required (per the NVD entry). Exploitation details ...

CVE-2022-28002

Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home...

CVE-2022-28002: Files or Directories Accessible to External Parties

Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home...

CVE-2022-28001: Improper Neutralization of Special Elements used in an SQL Command

Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id parameter...

CVE-2022-27346: Unrestricted Upload of File with Dangerous Type

Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-26180: Cross-Site Request Forgery (CSRF)

qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...

PT-2022-18741

Name of the Vulnerable Software and Affected Versions Movie Seat Reservation version 1 Description The issue is related to a SQL injection vulnerability. It affects the "/index.php?page=reserve" API endpoint via the id parameter. Recommendations For Movie Seat Reservation version 1, as a temporar...

PT-2022-18742

Name of the Vulnerable Software and Affected Versions Movie Seat Reservation version 1 Description The issue is related to an unauthenticated file disclosure vulnerability. This vulnerability can be exploited via the "/index.php?page=home" API endpoint. Recommendations For Movie Seat Reservation...

PT-2022-18386

Name of the Vulnerable Software and Affected Versions Ecommece-Website version 1.1.0 Description The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability. This is achieved through the "/admin/index.php?slides" API endpoint...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

CVE-2022-27108: Authorization Bypass Through User-Controlled Key

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

PT-2022-18225

Name of the Vulnerable Software and Affected Versions OrangeHRM version 4.10 Description The issue allows any user to create a timesheet in another user's account due to an Insecure Direct Object Reference IDOR via the endpoint "symfony/web/index.php/time/createTimesheet". Recommendations For...

PT-2022-18426

Name of the Vulnerable Software and Affected Versions Ecommerce-Website version 1.1.0 Description The issue allows attackers to upload a webshell via the Product Image component due to an unrestricted file upload at the "/public/admin/index.php?add product" API endpoint. Recommendations For...