CVE-2024-24140

Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'...

Nginx UI Injection Vulnerability

Nginx UI is a WebUI for Nginx by Jacky's personal developer. An injection vulnerability exists in versions of Nginx UI prior to 2.0.0.beta.12, which stems from the vulnerability to arbitrary command execution attacks when changing the value of testconfigcmd or startcmd...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the RHEL UBI (CVE-2023-27533)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-27533 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2023-27533 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Kashipara Food Management System SQL注入漏洞

Kashipara Food Management System is a food management system from Kashipara. A SQL injection vulnerability exists in version 1.0 of the Kashipara Food Management System, which is caused by a lack of validation of externally entered SQL statements in the password parameter of the loginCheck.php...

The vulnerability of the SMS sending function in OMICARD’s marketing messaging system allows a hacker to execute arbitrary SQL code and gain access to read, modify, or delete data.

The vulnerability of the SMS sending function in OMICARD’s marketing messaging system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL code and gain access to read, modify, or delete data...

CVE-2023-50993

Ruijie WS6008 v1.x v2.x ACRGOS11.96W3B2G2C6-0110221911 and WS6108 v1.x ACRGOS11.96W3B2G2C6-0110221911 was discovered to contain a command injection vulnerability via the function downFiles...

Apache Superset SQL注入漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an authenticated, remote attacker to send specially crafted SQL statements to the wherein JINJA macro...

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed multiple Java and Node.js security vulnerabilities listed herein. Vulnerability Details CVEID:CVE-2023-22045 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low...

KLive Security Vulnerabilities

KLive is a Qt QML based aggregated live streaming box by 32ns individual developers. A security vulnerability exists in KLive v.2019-1-19 and earlier versions, which stems from a SQL injection vulnerability in the web/user.php component...

ManageEngine Applications Manager SingleSignOn Cross-Site Scripting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Applications Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Online Matrimonial Project SQL Injection Vulnerability

Online Matrimonial Project is an online matrimonial program. A SQL injection vulnerability exists in Online Matrimonial Project v1.0 where certain parameters are not validated or escaped before they are used in a stitched SQL statement...

PT-2023-25376 · WordPress · Contact Form Generator

Name of the Vulnerable Software and Affected Versions: Contact Form Generator : Creative form builder for WordPress versions prior to 2.6.0 Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allow...

PT-2023-15084 · Unknown · Spiffy Calendar

Name of the Vulnerable Software and Affected Versions: Spiffy Calendar versions through 4.9.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

Online Food Ordering System SQL Injection Vulnerability

Online Food Ordering System is an online food ordering system by Carlo Montero, a personal developer. A SQL injection vulnerability exists in Online Food Ordering System v1.0, which is caused by insufficient filtering of the name parameter on the routers/add-item.php page...

PrestaShop SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image zoom and other features. A security vulnerability exists in PrestaShop Shoprunners versions prior to 2.2.1, which ste...

Adobe Commerce SQL注入漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a kind of merchants and brands for the world's leading digital commerce solutions. A SQL injection vulnerability exists in Adobe Commerce prior to version 2.4.7, which stems from the application's lack of validation of external...

Atos Unify OpenScape Command Injection Vulnerability

Atos Unify OpenScape is a native SIP-based real-time Voice over IP system from Atos Unify. A security vulnerability exists in Atos Unify OpenScape that originates from administrative access via the dtb page of the platform portal...

GitLab Enterprise Edition Injection Vulnerability

GitLab Enterprise Edition EE is a content management system from the US-based GitLab, Inc. GitLab Enterprise Edition suffers from an injection vulnerability that originates from hijacking certain links and buttons on the GitLab UI to a malicious page. The following versions are affected: versions...

GHSA-9JFQ-54VC-9RR2 Foreman Transpilation Enables OS Command Injection

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating...

CVE-2021-26837

SQL Injection vulnerability in SearchTextBox parameter in Fortra Formerly HelpSystems DeliverNow before version 1.2.18, allows attackers to execute arbitrary code, escalate privileges, and gain sensitive information...