663 matches found
CVE-2025-1132
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the ENtyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to inject malicious SQL commands. Please note that the...
PT-2025-5497 · WordPress · Wpspins Post/Page Copying Tool
Name of the Vulnerable Software and Affected Versions: WPSpins Post/Page Copying Tool versions 0 through 2.0.3 Description: The issue is related to improper control of code generation, allowing remote code inclusion due to a code injection flaw. This enables remote code inclusion, posing a...
Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java and Node.js
Summary There are multiple vulnerabilities in Java and Node.js used by IBM Cloud Transformation Advisor CVE-2024-52798, CVE-2024-47764, CVE-2024-21538, CVE-2024-21235, CVE-2024-21217, CVE-2024-21210, CVE-2024-21208, CVE-2024-10917. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION:...
CVE-2025-23218
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionarespecie.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands ...
TOTOLINK X5000R 安全漏洞
The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. The TOTOLINK X5000R suffers from a command injection vulnerability that stems from the "eMinute" parameter in setWiFiScheduleCfg failing to properly filter constructor special characters, commands, etc. The vulnerability can ...
CVE-2024-13162
SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848...
Campcodes Student Grading System 注入漏洞
Student Grading System is a student grading system. A SQL injection vulnerability exists in Student Grading System version 1.0, which stems from a lack of validation of externally entered SQL statements in the parameter id of the file /viewstudents.php. An attacker can exploit this vulnerability ...
PHPGurukul Complaint Management System 注入漏洞
Complaint Management System is a complaint management system. Complaint Management System suffers from an SQL injection vulnerability that stems from a lack of sufficient validation of the input of the state parameter in the /admin/category.php file. No details of the vulnerability are available ...
WordPress Advanced What should we write next about plugin <= 1.0.3 - SQL Injection vulnerability
SQL Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Advanced What should we write next about versions = 1.0.3...
WordPress AI-Engine plugin < 2.6.5 - Admin+ SQLi vulnerability
Admin+ SQLi vulnerability discovered by Emiliano Versini in WordPress Plugin AI Engine versions 2.6.5...
CVE-2024-12485
A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling System 1.0. This issue affects some unknown processing of the file /pages/department.php. The manipulation of the argument id leads to sql injection. The attack may be initiated...
U.S. Charges Chinese Hacker for Exploiting Zero-Day in 81,000 Sophos Firewalls
The U.S. government on Tuesday unsealed charges against a Chinese national for allegedly breaking into thousands of Sophos firewall devices globally in 2020. Guan Tianfeng aka gbigmao and gxiaomao, who is said to have worked at Sichuan Silence Information Technology Company, Limited, has been...
CVE-2024-11633
Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution...
PT-2024-36100 · Roninwp · Roninwp Fat Services Booking
Name of the Vulnerable Software and Affected Versions: Roninwp FAT Services Booking versions n/a through 5.6 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This problem impacts Roninwp FAT...
webkit: maliciously crafted webpage may be able to fingerprint the user
A flaw was found in WebKit. This flaw allows remote attackers to bypass security restrictions through an injection issue by persuading a victim to access a specially crafted website, enabling the attackers to fingerprint the user...
1000 Projects Portfolio Management System MCA 安全漏洞
1000 Projects Portfolio Management System MCA is an open source portfolio management system from 1000 Projects. A security vulnerability exists in 1000 Projects Portfolio Management System MCA version 1.0 due to an SQL injection in the parameter username...
SvelteKit 跨站脚本漏洞
SvelteKit is an open source web development framework from Svelte. A cross-site scripting vulnerability exists in SvelteKit versions prior to 2.8.3, which stems from an injection flaw that occurs when replacing placeholders without first escaping the content...
CVE-2024-7882
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Special Minds Design and Software e-Commerce allows SQL Injection. This issue affects e-Commerce: before 22.11.2024...
Ivanti Endpoint Manager 安全漏洞
Ivanti Endpoint Manager is an enterprise-grade endpoint management solution, mainly used for centralized management of various types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc., to achieve unified configuration, security control and remote operation and maintenanc...
Projectworlds Free Download Online Shopping System SQL注入漏洞
Projectworlds Free Download Online Shopping System is an online shopping system from Projectworlds India. Projectworlds Free Download Online Shopping System 192.168.1.88 and earlier versions have a SQL injection vulnerability that stems from a SQL injection vulnerability in the parameter id...