Vulnerabilities fixed in Synology Surveillance Station

Synology has fixed vulnerabilities in Surveillance Station. A malicious party can exploit the vulnerabilities to execute arbitrary code via SQL injection to execute arbitrary code, or gain access to sensitive data. Synology has released updates to fix the vulnerabilities in Surveillance Station...

The vulnerability of the “Add News” function in the phpMyFAQ web application allows a hacker to gain unauthorized access to the application.

The vulnerability of the “Add News” function in the phpMyFAQ web application is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the application...

PT-2024-23284 · Unknown · Contest Gallery

Name of the Vulnerable Software and Affected Versions: Contest Gallery versions prior to 21.3.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential unauthorized access or...

PT-2024-4013 · Ivanti · Ivanti Epm +1

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2022 SU5 and prior Description: The issue is related to an SQL Injection vulnerability in the Core server of Ivanti EPM, allowing an authenticated attacker within the same network to execute arbitrary code. Specifically, t...

PT-2024-22835 · Synology · Synology Surveillance Station

Name of the Vulnerable Software and Affected Versions: Synology Surveillance Station versions prior to 9.2.0-11289 Synology Surveillance Station versions prior to 9.2.0-9289 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used...

The vulnerability of the insertentry/saveentry function in the phpMyFAQ web application allows a hacker to gain unauthorized access to the application.

The vulnerability of the insertentry/saveentry function in the phpMyFAQ web application is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the application...

WordPress Plugin Quiz And Survey Master SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A SQL injection vulnerability exists in the WordPress...

PT-2024-22891 · Unknown · Campcodes Online Examination System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Examination System version 1.0 Description: A critical issue has been found in the code of the file "/adminpanel/admin/query/deleteExamExe.php". The manipulation of the id argument leads to SQL injection. The attack can be...

Complete Online Beauty Parlor Management System /forgot-password.php File SQL Injection Vulnerability

Complete Online Beauty Parlor Management System is an online beauty parlor management system. The Complete Online Beauty Parlor Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the email parameter of the...

The vulnerability of the Advantech WebAccess remote monitoring software lies in the lack of security measures for SQL query structures, allowing attackers to execute arbitrary SQL queries against the database.

The vulnerability of the Advantech WebAccess remote monitoring software lies in the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database remotely...

CVE-2024-28393

SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProcess method...

PHP Task Management System 安全漏洞

SourceCodester Task Management System is a task management system. A security vulnerability exists in PHP Task Management System version 1.0 that stems from vulnerability to SQL injection attacks via update-employee.php...

Mergen Software Quality Management System SQL注入漏洞

Mergen Software Quality Management System is a quality management system from Mergen, Turkey. A SQL injection vulnerability exists in Mergen Software Quality Management System version 25032024 and prior versions, which results from improper neutralization of special elements...

Scalapay 安全漏洞

Scalapay is an e-commerce software from Scalapay Inc. A security vulnerability exists in Scalapay v.1.2.41 and earlier versions that stems from the presence of a SQL injection vulnerability. An attacker can exploit the vulnerability to escalate privileges via the...

CVE-2024-2776

A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The...

DingFlow 安全漏洞

DingFlow is DingFlow open source is committed to helping small and medium-sized intelligent office system. DingFlow v.2.0.0 version of a security vulnerability , the vulnerability stems from the system/role/list interface of the dataScope parameter SQL injection vulnerability...

CVE-2024-2774

A vulnerability classified as critical was found in Campcodes Online Marriage Registration System 1.0. This vulnerability affects unknown code of the file /user/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has be...

Sentrifugo SQL注入漏洞

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2, which originates from a lack of validation of...

Campcodes Complete Online DJ Booking System SQL注入漏洞

Campcodes Complete Online DJ Booking System is an online DJ booking system from Campcodes, Inc. A SQL injection vulnerability exists in version 1.0 of the Campcodes Complete Online DJ Booking System, which originates from a SQL injection vulnerability in the searchdata parameter of the...

Autoexpress 安全漏洞

AutoExpress is a car dealership application for car dealers and car buyers by Raymart DG Individual Developer. A security vulnerability exists in Autoexpress version 1.3.0, which stems from the presence of a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execu...