Osclass Security Vulnerabilities

Osclass is an open source content management system CMS based on PHP and MySQL for creating and managing classified ads websites. A security vulnerability exists in Osclass version 5.1.2, which stems from vulnerability to SQL injection attacks...

PT-2024-20897 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the editid parameter in the /zms/admin/changeimage.php API endpoint. This enables attackers to potentially extract or modif...

WordPress Plugin MoveTo SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin MoveTo suffers from a SQL...

SEMCMS Security Breach

SEMCMS is a multilingual content management system CMS for foreign trade websites. A security vulnerability exists in SEMCMS v.4.8, which originates from an SQL injection vulnerability. The vulnerability can be exploited to execute arbitrary code and obtain sensitive information via the...

PT-2024-18104 · WordPress · Wp Ecommerce

Name of the Vulnerable Software and Affected Versions: WP eCommerce plugin for WordPress versions up to, and including, 3.15.1 Description: The issue is related to time-based blind SQL Injection via the cart contents parameter due to insufficient escaping on the user-supplied parameter and lack o...

PT-2024-20550

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0 Description A guest user could exploit a chart data REST API and send arbitrary SQL statements that, on error, could leak information from the underlying...

PT-2024-21193 · Miniorange · Miniorange Malware Scanner

Name of the Vulnerable Software and Affected Versions: miniorange Malware Scanner versions through 4.7.2 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection'. This allows for potential exploitation by injecting...

CVE-2024-1924

A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /getmembershipamount.php. The manipulation of the argument membershipTypeId leads to sql injection. It is possible to initiate the attack remotely...

CVE-2024-24095

Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection...

Scholars Tracking System 安全漏洞

Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. A SQL injection vulnerability exists in Scholars Tracking System version 1.0, which stems from a lack of validation of externally entered SQL statements when updating employment status information, and...

Simple Student Attendance System SQL Injection Vulnerability

Simple Student Attendance System is a simple student attendance system. A SQL injection vulnerability exists in Simple Student Attendance System version 1.0, which stems from an incorrect manipulation of the parameter id that can lead to sql injection...

Kashipara Dynamic Lab Management System SQL Injection Vulnerability

Kashipara Dynamic Lab Management System is a dynamic lab management system from Kashipara. A SQL injection vulnerability exists in Kashipara Dynamic Lab Management System version V1.0, which originates from a vulnerability that could allow a remote attacker to execute arbitrary code via specially...

Inventory Management System SQL Injection Vulnerability

Inventory Management System is an inventory management system by stemword individual developers. A SQL injection vulnerability exists in Free and Open Source Inventory Management System version 1.0, which stems from an incorrect operation of the parameter customer that can lead to an SQL injectio...

CVE-2024-25247

SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude and longitude parameters...

Nagios XI SQL Injection Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. Nagios XI version 2024R1.01 suffers from a SQL injection vulnerability that originates from allowing remot...

The vulnerability of the SQL component of the Java framework Apache Camel, which allows a hacker to execute arbitrary code.

The vulnerability of the SQL component of the Java framework Apache Camel is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL

A flaw was found in PostgreSQL. A late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL can allow an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling a safe refre...

PT-2024-18303 · Limbas · Limbas

Name of the Vulnerable Software and Affected Versions: Limbas version 5.2.14 Description: A vulnerability was found in an unknown functionality of the file main admin.php. The manipulation of the tab group argument leads to sql injection. The complexity of an attack is rather high, and the...

CVE-2023-51828

A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers to execute arbitrary SQL commands via the query parameter in getnextnotice function...

ChurchCRM Security Breach

ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM version 5.5.0, which stems from a SQL blind time-based vulnerability in the familyId GET parameter of the ConfirmReport.php page...