📄 Watcharr 1.43.0 Remote Code Execution

Watcharr versions 1.43.0 and below suffer from a remote code execution vulnerability. CVE-2024-48827 exploit by Suphawith Phusanbai Affected Watcharr version 1.43.0 and below. import argparse import requests import json import jwt from pyfiglet import Figlet f = Figletfont='slant',width=100...

PT-2025-11118

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks GlobalProtect app on Windows affected versions not specified Description: A remote attacker can run ActiveX controls within the context of an authenticated Windows user, enabling them to run commands as if they are a...

Apache Tomcat code-related vulnerabilities

Apache Tomcat is a lightweight Web application server from the Apache USA Foundation. It is used to implement support for Servlets and JavaServer Page JSP. A code issue vulnerability exists in Apache Tomcat that stems from the presence of an unchecked error condition vulnerability that could thro...

1000 Projects Bookstore Management System SQL Injection Vulnerability

1000 Projects Bookstore Management System is an open source bookstore management system from 1000 Projects. A SQL injection vulnerability exists in 1000 Projects Bookstore Management System version 1.0, which originates from a SQL injection vulnerability in the unm parameter in the Login componen...

Advantech ADAM-5630 security vulnerabilities

The Advantech ADAM-5630 is an edge intelligent data acquisition controller from Advantech China. A security vulnerability exists in the Advantech ADAM-5630 that originates from user credentials being shared in plain text between the device and the user source device during the login process...

Nextcloud: Open redirect when logging in with user_oidc

An open redirect vulnerability was discovered in Nextcloud's useroidc app. This vulnerability allowed an attacker to redirect users to a malicious website during the login process...

CVE-2024-42657: Missing Encryption of Sensitive Data

An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process...

CVE-2024-42657

An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process...

CVE-2024-41733: Exposure of Sensitive Information to an Unauthorized Actor

In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the...

PT-2024-6829 · Sap · Sap Commerce Cloud

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud affected versions not specified Description: The issue is related to insufficient protection of service data in SAP Commerce Cloud, allowing a remote attacker to potentially disclose protected information. In SAP Commerce,...

Dahua Security Cameras Improper Authentication (CVE-2021-33045)

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for...

CVE-2024-3102 JSON Injection in mintplex-labs/anything-llm

A JSON Injection vulnerability exists in the mintplex-labs/anything-llm application, specifically within the username parameter during the login process at the /api/request-token endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks...

CVE-2024-3102 JSON Injection in mintplex-labs/anything-llm

A JSON Injection vulnerability exists in the mintplex-labs/anything-llm application, specifically within the username parameter during the login process at the /api/request-token endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks...

CVE-2024-3102 JSON Injection in mintplex-labs/anything-llm

A JSON Injection vulnerability exists in the mintplex-labs/anything-llm application, specifically within the username parameter during the login process at the /api/request-token endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks...

CVE-2024-3102

CVE-2024-3102 affects mintplex-labs/anything-llm via a JSON Injection in the login flow, specifically the username parameter at /api/request-token. The root cause is improper handling of values, enabling brute-force attempts without prior username knowledge and, once the password is known, blind ...

Online Fire Reporting System OFRS - SQL Injection Authentication Bypass

Exploit Title: Online Fire Reporting System SQL Injection Authentication Bypass Date: 02/10/2024 Exploit Author: Diyar Saadi Vendor Homepage: https://phpgurukul.com/online-fire-reporting-system-using-php-and-mysql/ Software Link:...

CVE-2024-3413

A vulnerability has been found in SourceCodester Human Resource Information System 1.0 and classified as critical. This vulnerability affects unknown code of the file initialize/loginprocess.php. The manipulation of the argument hremail/hrpassword leads to sql injection. The attack can be initiat...

CVE-2024-3413 SourceCodester Human Resource Information System login_process.php sql injection

A vulnerability has been found in SourceCodester Human Resource Information System 1.0 and classified as critical. This vulnerability affects unknown code of the file initialize/loginprocess.php. The manipulation of the argument hremail/hrpassword leads to sql injection. The attack can be initiat...

Human Resource Information System security vulnerabilities

Human Resource Information System is a human resource information system. A security vulnerability exists in version 1.0 of the SourceCodester Human Resource Information System, which results from an SQL injection vulnerability in the hremail/hrpassword parameters of the initialize/loginprocess.p...

Simple Inventory Management System 1.0 SQL Injection

Exploit Title: Simple Inventory Management System - SQL Injection Google Dork: N/A Application: Simple Inventory Management System Date: 26.02.2024 Bugs: SQL Injection Exploit Author: SoSPiro Vendor Homepage: https://www.sourcecodester.com/ Software Link:...