CVE-2022-2673

A vulnerability was found in Rigatur Online Booking and Hotel Management System aff6409. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Request Handler. The manipulation of the argument email/pass leads to s...

CVE-2022-2673 Rigatur Online Booking and Hotel Management System POST Request login.php sql injection

A vulnerability was found in Rigatur Online Booking and Hotel Management System aff6409. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Request Handler. The manipulation of the argument email/pass leads to s...

CVE-2022-2664 Private Cloud Management Platform POST Request global_config_query improper authentication

A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcxmanagement/globalconfigquery of the component POST Request Handler. The manipulation leads to improper authentication. It is possible to launc...

GitLab 0.0 < 15.0.5 / 15.1 < 15.1.4 / 15.2 < 15.2.1 (CVE-2022-2456)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for...

CVE-2022-2273

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request...

CVE-2022-2273

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request...

Student Result or Employee Database < 1.8.0 - Unauthorised REST Calls

The plugin has a flawed permission callback in its REST endpoints, allowing unauthenticated attackers to call them and add/edit/delete arbitrary student for example POST /wp-json/v2/ssradddata HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...

Better Search and Replace < 1.4.1 - Admin+ SQLi

The plugin does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks POST /wp-admin/tools.php?page=better-search-replace&bsr-ajax=processsearchreplace HTTP/1.1 Accept: application/json,...

GitLab CE/EE 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in all versions of GitLab CE/EE prior to 15.0.5...

CVE-2022-34576

A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2022-34577

A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2022-34577

A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2022-34576

A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2022-34577

A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request...

Cross site request forgery (csrf)

A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2022-34577

A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2022-34577

CVE-2022-34577 affects WAVLINK WN535 G3 (firmware M35G3R.V5030.180927) due to an adm.cgi component vulnerability that allows arbitrary code execution via a crafted POST request. Multiple connected sources confirm a remote-code-execution vector through POST to adm.cgi, with high impact (C/H/I/A) a...

CVE-2022-34576

WAVLINK WN535 G3 M35G3R.V5030.180927 is affected by a flaw in /cgi-bin/ExportAllSettings.sh that lets an attacker execute arbitrary code via a crafted POST request. Exploitation could lead to unauthorized access to router settings and potentially data disclosure or modification, as described in t...

WAVLINK WN535 G3 安全漏洞

WAVLINK WN535 G3 is a wireless router from China RuiYin Technology WAVLINK. A security vulnerability exists in WAVLINK WN535 G3 M35G3R.V5030.180927 version. An attacker can exploit the vulnerability to execute arbitrary code via a specially crafted POST request...

PT-2022-22215 · Wavlink · Wavlink Wn535G3

Name of the Vulnerable Software and Affected Versions: WAVLINK WN535 G3 M35G3R.V5030.180927 Description: A vulnerability exists in the /cgi-bin/ExportAllSettings.sh endpoint, allowing attackers to execute arbitrary code via a crafted POST request. Recommendations: For WAVLINK WN535 G3...