DerbyNet 安全漏洞

DerbyNet is a simple code for a match broadcasting program. A cross-site scripting vulnerability exists in the DerbyNet order parameter due to improper validation of user-supplied input by the checkin.php script. An attacker could use this vulnerability to steal the victim's cookie-based...

SUSE CVE-2024-29031

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the order parameter of...

Online Mobile Management Store SQL Injection Vulnerability

Online Mobile Management Store is an online mobile store management system. A SQL injection vulnerability exists in Online Mobile Management Store version 1.0, which originates from a SQL injection vulnerability in the parameter id of the file /admin/orders/vieworder.php...

PT-2024-20229 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns a SQL Injection vulnerability. Specifically, the findInOutMaterialCount function in com.jsh.erp.controller.DepotHeadController does not adequately filter the column and order parameters,...

jshERP SQL Injection Vulnerability

jshERP Huaxia ERP is a homegrown ERP system developed by a Chinese individual developer, Ji Sheng Hua. A SQL injection vulnerability exists in jshERP v3.3, which is caused by insufficient filtering of the "column" and "order" parameters...

Information disclosure

An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the idorder parameter...

Webkul QloApps Security Breach

Webkul QloApps is free open source hotel booking and online reservation system. A security vulnerability exists in Webkul QloApps versions prior to v1.6.0, which stems from a vulnerability that allows an attacker to obtain sensitive information via the idorder parameter...

Weitong Mall SQL Injection Vulnerability

Weitong Mall is a shopping mall system developed by fuyanglipengjun. A SQL injection vulnerability exists in Weitong Mall version 1.0.0, which originates from platform-shopsrcmain. The vulnerability is caused by an unknown function in platform-shopsrcmain.esourcescomplatformdaoOrderDao.xml, which...

PT-2023-8392 · Nginx-Ui · Nginx-Ui

Name of the Vulnerable Software and Affected Versions: Nginx-UI versions prior to 2.0.0.beta.9 Description: The issue is related to a lack of protection against SQL query structure exploitation in the Nginx UI server. This may allow a remote attacker to gain unauthorized access to protected...

GHSA-9JJC-GRG5-67GJ SQL injection vulnerability in Meshery

A SQL injection vulnerability in Meshery before 0.6.179 allows a remote attacker to obtain sensitive information and execute arbitrary code via the order parameter...

CVE-2023-46575

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter...

CVE-2023-46575

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter...

PT-2023-30096 · Meshery · Meshery

Name of the Vulnerable Software and Affected Versions: Meshery versions prior to 0.6.179 Description: A SQL injection issue exists, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the order parameter. Recommendations: For versions prior to 0.6.179,...

CVE-2023-46575

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter...

CVE-2023-46575

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter...

Dooblou WiFi File Explorer 跨站脚本漏洞

Dooblou WiFi File Explorer is a free WiFi file explorer from Dooblou. A cross-site scripting vulnerability exists in Dooblou WiFi File Explorer version 1.13.3, which stems from the parameter search/order/download/mode that causes cross-site scripting...

QuickJob Portal 6.1 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

CVE-2023-2607

The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2023-19818 · WordPress · Active Directory Integration

Name of the Vulnerable Software and Affected Versions: Active Directory Integration plugin for WordPress versions up to and including 4.1.4 Description: The issue allows for time-based SQL Injection due to insufficient escaping on the user-supplied orderby and order parameters and lack of...

PT-2023-20465 · WordPress · Multiple Page Generator Plugin

Name of the Vulnerable Software and Affected Versions: Multiple Page Generator Plugin for WordPress versions up to, and including, 3.3.17 Description: The issue allows for time-based SQL Injection via the orderby and order parameters due to insufficient escaping on the user-supplied parameter and...