CVE-2024-12961: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in 1000 Projects Portfolio Management System MCA 1.0. Affected is an unknown function of the file /updateachdetails.php. The manipulation of the argument q leads to sql injection. It is possible to launch the attack remotely. The exploi...

PT-2024-9930 · Unknown · 1000 Projects Portfolio Management System Mca

Name of the Vulnerable Software and Affected Versions: 1000 Projects Portfolio Management System MCA version 1.0 Description: The issue is related to the update ex detail.php script in the Portfolio Management System, where the q parameter is not properly sanitized, leading to a SQL injection...

CVE-2024-12892: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in code-projects Online Exam Mastering System 1.0. Affected by this vulnerability is an unknown functionality of the file /sign.php?q=account.php. The manipulation of the argument name/gender/college leads to cross site scripting. The attack can...

WordPress plugin G Web Pro Store Locator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-11682: Improper Neutralization of Input During Web Page Generation

The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2024-17188 · WordPress · G Web Pro Store Locator

Name of the Vulnerable Software and Affected Versions: G Web Pro Store Locator plugin for WordPress versions up to, and including, 2.1 Description: The issue is related to Reflected Cross-Site Scripting via the q parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-12187: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in 1000 Projects Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /showbook.php. The manipulation of the argument q leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2024-52724

ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php...

Introducing new Amazon Q Developer plugin for Wiz

New plugin enables AWS and Wiz customers to leverage generative AI to improve their cloud security posture...

CVE-2024-50334 Semicolon Path Injection on API /api;/config

Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT...

Liferay Portal和Liferay DXP 跨站请求伪造漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DX...

Leotheme Leo Product Search Module 安全漏洞

Leotheme Leo Product Search Module is a product search module for a website from Leotheme, Inc. A security vulnerability exists in Leotheme Leo Product Search Module 2.1.6 and earlier versions, which stems from a cross-site scripting vulnerability that allows remote attackers to execute arbitrary...

CVE-2024-42697: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function...

CVE-2024-42697

Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function...

CVE-2024-8891

An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4...

CVE-2024-8891

An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4...

CVE-2024-8890

An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure communication channel from being establish...

CVE-2024-8891 Exposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMT

An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4...

CVE-2024-8891 Exposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMT

An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4...

CVE-2024-8891

CVE-2024-8891 applies to CIRCUTOR Q-SMT, firmware 1.0.4. The vulnerability allows an attacker with no knowledge of current users to enumerate potential users by observing server responses, revealing whether a user exists. This is a user enumeration/ private information exposure issue affecting th...