PT-2022-21008

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows deletion of any file via the "/ofrs/classes/Master.php?f=delete img" API endpoint. Recommendations For Online Fire Reporting System version 1.0, restrict access to the...

PT-2022-21016

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the "/ofrs/admin/?page=requests/view request&id=" API endpoint, specifically targeting the id variable. This could potentially lead to unauthorized...

PT-2022-21014

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the "/ofrs/admin/?page=teams/manage team&id=" API endpoint, specifically through the id variable. This could potentially lead to unauthorized access or...

CVE-2022-31974: Improper Neutralization of Special Elements used in an SQL Command

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=...

CVE-2022-31984: Improper Neutralization of Special Elements used in an SQL Command

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/takeaction.php?id=...

CVE-2022-31978: Improper Neutralization of Special Elements used in an SQL Command

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleteinquiry...

CVE-2022-31975: Improper Neutralization of Special Elements used in an SQL Command

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manageuser&id=...

PT-2022-21012

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the /ofrs/classes/Master.php?f=delete team API endpoint, specifically through the f parameter. This could potentially lead to unauthorized data access ...

CVE-2022-29598

Solutions Atlantic Regulatory Reporting System (RRS) v500 is affected by a reflected Cross‑Site Scripting (XSS) vulnerability in RRSWeb/maint/ShowDocument/ShowDocument.aspx. The issue arises from the fileName parameter being reflected into a JavaScript context, enabling injection of arbitrary scr...

CVE-2022-29598: Improper Neutralization of Input During Web Page Generation

Solutions Atlantic Regulatory Reporting System RRS v500 is vulnerable to an reflected Cross-Site Scripting XSS vulnerability via RRSWeb/maint/ShowDocument/ShowDocument.aspx...

PT-2022-19718

Name of the Vulnerable Software and Affected Versions Solutions Atlantic Regulatory Reporting System RRS version v500 Description The issue is a reflected Cross-Site Scripting XSS vulnerability. It can be exploited via the "RRSWeb/maint/ShowDocument/ShowDocument.aspx" API endpoint. Recommendation...

Online Fire Reporting System 1.0 SQL Injection

Title: Online Fire Reporting System 1.0 SQLi Author: nu11secur1ty Date: 05.24.2022 Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15346/online-fire-reporting-system-phpoop-free-source-code.html Reference:...

Exploit for Path Traversal in Solutions-Atlantic Regulatory_Reporting_System

CVE-2022-29597: Local File Inclusion in RSS v500 The RRSht...

Exploit for Cross-site Scripting in Solutions-Atlantic Regulatory_Reporting_System

CVE-2022-29598 : Reflected Cross-Site Scripting XSS in RSS v...

Dream Report ODS Remote Connector privilege escalation vulnerability

Summary A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can provide a malicious file to trigger this vulnerability. Tested Version...

File upload vulnerability in health collection reporting system (CNVD-2021-24510)

Health collection and reporting system using PHP + mysql development, open source code, to facilitate secondary development. Health Collection and Reporting System has a file upload vulnerability that can be exploited by attackers to gain control of the server...

IBM MQ 8.0 <= 8.0.0.11 / 9.0 <= 9.0.0.6 LTS / 9.1 <= 9.1.0.1 LTS / 9.1.1 < 9.1.2 CD (870492)

The version of IBM MQ Server running on the remote host is affected by a vulnerability that allows a local attacker to cause a denial of service within the error log reporting system. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...

Arbitrary File Read Vulnerability in UFIDA NC-IUFO Reporting System

UFIDA Network Technology Co. Founded in 1988, UFIDA is an advanced global provider of cloud services, software, and financial services for enterprises and public organizations. An arbitrary file read vulnerability exists in the UFIDA NC-IUFO Reporting System, which can be exploited by attackers t...

SQL Injection Vulnerability in Qixing Fault Reporting System (WeChat Public Version) 40.0

Servicedesk can be used as an enterprise fault reporting platform. The system supports secondary authentication, problem statistics, WeChat notification and other functions. A SQL injection vulnerability exists in Qixing Fault Reporting System WeChat Public Version 40.0, which can be exploited by...

SQL injection vulnerability in qu***.aspx page of Qixing Fault Reporting System in Shanghai Tsuenlu Software Development Studio.

Qixing Fault Reporting System is a platform based on ASP.NET language to help organizations to report faults. Shanghai Tsuen Road Software Development Studio Qixing Star Fault Reporting System qu.aspx page has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive...