WordPress plugin WP Post Author SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

SEMCMS 安全漏洞

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A SQL injection vulnerability exists in SEMCMS version 4.8, which originates from the lack of validation of external SQL statements in SEMCMSMain.php. An attacker can exploit this vulnerability to execut...

QNAP QTS and QuTS hero operating system command injection vulnerability

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...

OpenRapid RapidCMS 安全漏洞

OpenRapid RapidCMS is OpenRapid open source a fast and easy to use CMS system. A security vulnerability exists in OpenRapid RapidCMS v1.3.1, which originates from a SQL injection vulnerability via the password parameter on /resource/runlogin.php...

SportsNET SQL注入漏洞

SportsNET is a sports event network application from SportsNET, Inc. SportsNET suffers from a SQL injection vulnerability that can be exploited by an attacker to retrieve, update, and delete all information in the database via a specially crafted SQL query...

CVE-2024-7838

A vulnerability was found in itsourcecode Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /addcategory.php. The manipulation of the argument cname leads to sql injection. The attack may be launched remotely. The...

CVE-2024-7700

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing...

SUSE CVE-2024-42005

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values and valueslist methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg...

Korenix JetPort 5601 操作系统命令注入漏洞

The Korenix JetPort 5601 is an intelligent serial device server from Korenix. A security vulnerability exists in Korenix JetPort 5601 version 1.2 and earlier, which stems from the lack of encryption of sensitive data in the resulting eavesdropping...

PT-2024-37071

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine Applications Manager versions 17.0900 and below Description The issue concerns an authenticated admin-only SQL Injection in the Create Monitor feature. Recommendations For versions 17.0900 and below, update to a version...

itsourcecode Alton Management System SQL注入漏洞

Alton Management System is an open source content management system from itsourcecode. A SQL injection vulnerability exists in version 1.0 of itsourcecode Alton Management System, which is caused by an SQL injection vulnerability in the rcode function of the search.php page...

PT-2024-38130 · Unknown · Sourcecodester School Fees Payment System

Name of the Vulnerable Software and Affected Versions: SourceCodester School Fees Payment System version 1.0 Description: A critical issue affects some unknown functionality of the file /manage user.php. The manipulation of the id argument leads to sql injection. The attack can be launched...

CVE-2024-40560

Tmalldemo before v2024.07.03 was discovered to contain a SQL injection vulnerability...

less: OS command injection

An OS command injection flaw was found in Less. Since quoting is mishandled in filename.c, opening files with attacker-controlled file names can lead to OS command execution. Exploitation requires the LESSOPEN environment variable, which is set by default in many common cases...

WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

Content Injection vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin WooCommerce versions = 8.9.2...

Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities

Summary QRadar Suite Software includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version. Vulnerability Details...

MegaBIP Security Vulnerabilities

MegaBIP is a software used to create BIP websites. A security vulnerability exists in MegaBIP 5.09 and earlier versions that stems from the presence of a SQL injection vulnerability that allows an attacker to gain site administrator privileges, including access to the administration panel and the...

PT-2024-26978 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.4 SuiteCRM versions prior to 8.6.1 Description: The issue is related to poor input validation, which allows for SQL Injection in the EmailUIAjax displayView controller. Recommendations: For versions prior to...

CVE-2024-5733

A vulnerability was found in itsourcecode Online Discussion Forum 1.0. It has been rated as critical. This issue affects some unknown processing of the file registerme.php. The manipulation of the argument eaddress leads to sql injection. The attack may be initiated remotely. The exploit has been...

SourceCodester Stock Management System SQL注入漏洞

Sourcecodester Stock Management System is an inventory management system. A SQL injection vulnerability exists in SourceCodester Stock Management System version 1.0, which stems from a SQL injection caused by the brandName parameter of the file createBrand.php...