53 matches found
EUVD-2024-31528
Malicious code in bioql PyPI...
EUVD-2025-1755
Malicious code in bioql PyPI...
XWiki Platform DBMS_XMLGEN DBMS_XMLQUERY Code Execution
The vulnerability of the DBMSXMLGEN and DBMSXMLQUERY functions of the XWiki Platform for creating collaborative web applications is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending...
CVE-2022-22880
Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId...
WordPress plugin Directorist has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2024-33819
Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Save Query function...
GHSA-JGX4-7V3V-VWFM Elasticsearch allocation of resources without limits or throttling leads to crash
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function...
CVE-2024-39018
harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...
PT-2024-28328
Name of the Vulnerable Software and Affected Versions harvey-woo cat5th/key-serializer version 0.2.5 Description The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties through the function "query". This is a result of prototype...
CVE-2024-33819
Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Save Query function...
CVE-2024-33819: Improper Neutralization of Input During Web Page Generation
Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Save Query function...
Globitel SpeechLog Analytics security vulnerability
Globitel SpeechLog Analytics is a speech analysis module from Globitel. A security vulnerability exists in Globitel SpeechLog Analytics version v8.1, which was discovered to contain a stored cross-site scripting XSS vulnerability in the "Save Query" function...
CVE-2024-33819
Globitel KSA SpeechLog version v8.1 is affected by a stored cross-site scripting (XSS) vulnerability within the Save Query function. This flaw allows for the execution of malicious scripts when the function is used. As a mitigation, it is recommended to disable the Save Query function until a for...
CVE-2024-33819
Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Save Query function...
PT-2024-25499 · Globitel · Globitel Ksa Speechlog
Name of the Vulnerable Software and Affected Versions: Globitel KSA SpeechLog version 8.1 Description: A stored cross-site scripting XSS issue was found in the Save Query function. Recommendations: For version 8.1, consider disabling the Save Query function until a patch is available to prevent...
Sql injection
EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records...
PT-2023-19628 · Nozomi Networks · Cmc +1
Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: An access control issue was found due to restrictions not being enforced in the debug functionality. This allows an authenticated user with reduced visibility to obtain unauthorized...
HGiga MailSherlock operating system command injection vulnerability
Hgiga MailSherlock is an enterprise email auditing system from China Henderson Technology Hgiga. HGiga MailSherlock version 4.5 suffers from an operating system command injection vulnerability, which originates from an insufficient filtering of user input by the query function. An attacker could...
CVE-2023-24841: Improper Neutralization of Special Elements used in an OS Command
HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or...