ZoneMinder SQL Injection Vulnerability (CNVD-2019-04688)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras and more. ZoneMinder 1.32.3 and earlier versions of skins/classic/views/events.php file has a SQL injection vulnerability , a remote attacker can with the help of 'filterQueryterms0cnj'...

SQL Injection Vulnerability in YCCMS v3.3

YCCMS is a PHP version of a lightweight CMS builder. YCCMS v3.3 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in the Frontend of Worklog 25.0 System by Kaixin Worklog

Worklog is a B/S based software for structuring intra-enterprise collaborative work. A SQL injection vulnerability exists in the frontend of the Qixing Worklog 25.0 system, which can be exploited by attackers to manipulate the database...

SQL Injection Vulnerability in Penta Campus Network Application System Management Software

PantoSchool.Net is a complete solution for networked learning schools! A SQL injection vulnerability exists in PantoSchool.Net Application System Management Software. An attacker can exploit the vulnerability to obtain sensitive information from the database...

SQL Injection Vulnerability in the Frontend Pr***.ashx Page of eDoc, an Electronic Document Repository

Electronic document library eDoc is a click document management system developed by Anhui Qixing Studio. SQL injection vulnerability exists in the front-end Pr.ashx page of eDoc, which can be exploited by attackers to obtain sensitive information from the database...

(0Day) Hewlett Packard Enterprise Intelligent Management Center PrimeFaces Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PrimeFaces endpoint. When parsing the...

(0Day) Hewlett Packard Enterprise Intelligent Management Center iccSelectCommand Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the beanName parameter provid...

(0Day) Hewlett Packard Enterprise Intelligent Management Center faultDevParasSet Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

(0Day) Hewlett Packard Enterprise Intelligent Management Center devGroupSelect Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

(0Day) Hewlett Packard Enterprise Intelligent Management Center faultInfo_content Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

(0Day) Hewlett Packard Enterprise Intelligent Management Center legend Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

SQL Injection Vulnerability in the Website Building System of Beijing Nightcat Network Technology Co.

Beijing Nightcats Network Technology Co., Ltd. is a company that specializes in providing website building services to users. There is a SQL injection vulnerability in the website building system of Beijing Nightcats Network Technology Co. Ltd, which can be exploited by attackers to obtain...

SQL Injection Vulnerability in Smart Meter Collective Reading Management System Lo***.aspx Page

Qingdao Automatic Instrumentation Co., Ltd. is a new joint-stock enterprise integrating R&D and manufacturing. There is a SQL injection vulnerability in the Lo.aspx page of the Intelligent Instrumentation Collector Management System, which can be exploited by attackers to obtain sensitive...

Remote Code Execution (RCE)

richfaces is vulnerable to Remote code Execution RCE attacks. The vulnerability is due to improper Expression Language EL sanitization in the UserResource class. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects gadget chains...

SQL Injection Vulnerability in Bidding System Bid Frontend ge***.aspx Page

Qixing Bidding System Bid is a system suitable for enterprises to collect information on bidding information of government procurement, engineering construction, land grant, etc., and to track the progress of works and payment of successful projects. A SQL injection vulnerability exists in the...

SQL Injection Vulnerability in File System Profile Frontend Bi***.ashx Page

The filing system Profile is an in-house employee management software. A SQL injection vulnerability exists in the frontend Bi.ashx page of File System Profile, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in PHPMyWind si***_up***.php File

PHPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A SQL injection vulnerability exists in the PHPMyWind siup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in PHPMyWind in***_up***.php File

PHPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A SQL injection vulnerability exists in the PHPMyWind inup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in PHPMyWind we***_up***.php File

PPMyWind is a PHP + MySQL based development of W3C-compliant building engine . A SQL injection vulnerability exists in the PHPMyWind weup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...

Yeswiki Cercopitheque SQL Injection Vulnerability

Yeswiki Cercopitheque is a Wiki system written in PHP. The system is mainly used to create and manage websites in a collaborative way. A SQL injection vulnerability exists in the 'Bazar' page in Yeswiki Cercopitheque 2018-06-19-1 and earlier versions. A remote attacker can exploit the vulnerabili...