KevinLAB BEMS 1.0 Authenticated File Path Traversal / Information Disclosure

KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy Management System Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy...

MetInfo SQL Injection Vulnerability (CNVD-2021-51809)

Metinfo MetInfo is a content management system CMS developed by China Mito Metinfo using PHP and Mysql. A SQL injection vulnerability exists in index.php in Metinfo 7.0.0beta, which arises from a database-based application that lacks validation of externally entered SQL statements. An attacker ca...

ECTouch SQL Injection Vulnerability

ECTouch is an application. An open source mobile mall system to create an enterprise exclusive mobile mall. ECTouch suffers from a SQL injection vulnerability, which originates from the SQL injection vulnerability in ECTouch v2 generated through the integralmin parameter in index.php. An attacker...

Advantech R-SeeNet options.php local file inclusion (LFI) vulnerability

Summary A local file inclusion LFI vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 20.10.2020. A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability. Tested...

CVE-2020-18144

SQL Injection Vulnerability in ECTouch v2 via the integralmin parameter in index.php...

Sql injection

SQL Injection Vulnerability in ECTouch v2 via the integralmin parameter in index.php...

CVE-2020-18144

SQL Injection Vulnerability in ECTouch v2 via the integralmin parameter in index.php...

CVE-2020-18144

CVE-2020-18144 is a SQL injection vulnerability in ECTouch v2 exploited via the integral_min parameter in index.php. Root cause: improper input handling leads to SQL commands being executed. Affected software: ECTouch v2 (open-source mobile mall system). Impact (per sources): high severity with p...

CVE-2020-29146

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

CVE-2020-29146: Improper Neutralization of Input During Web Page Generation

A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...

PT-2021-10138

Name of the Vulnerable Software and Affected Versions: ECTouch version v2 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the integral min parameter in the "index.php" endpoint. Recommendations: For ECTouch version v2, avoid using the integral min...

CVE-2020-18144: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection Vulnerability in ECTouch v2 via the integralmin parameter in index.php...

CVE-2020-21132

SQL Injection vulnerability in Metinfo 7.0.0beta in index.php...

CVE-2020-21132

SQL Injection vulnerability in Metinfo 7.0.0beta in index.php...

Sql injection

SQL Injection vulnerability in Metinfo 7.0.0beta in index.php...

CVE-2020-21132

MetInfo 7.0.0beta SQL injection in index.php is exposed. The vulnerability stems from lack of validation of externally entered SQL statements, allowing an attacker to execute arbitrary SQL. CVSS details indicate high to critical impact across confidentiality, integrity, and availability (C:H, I:H...

CVE-2020-21132

SQL Injection vulnerability in Metinfo 7.0.0beta in index.php...

Metinfo MetInfo SQL注入漏洞

Metinfo MetInfo is a content management system CMS developed by China Mito Metinfo using PHP and Mysql. A SQL injection vulnerability exists in index.php in Metinfo 7.0.0beta, which arises from a database-based application that lacks validation of externally entered SQL statements. An attacker ca...

CVE-2020-21132: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Metinfo 7.0.0beta in index.php...

PT-2021-10232

Name of the Vulnerable Software and Affected Versions: ThinkSAAS version 2.7 Description: The issue allows remote attackers to modify the description of any user's photo. This is achieved via the photoid and photodesc parameters in the "index.php?app=photo" component. Recommendations: For ThinkSA...