PT-2023-31491 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA versions prior to 11.10 Description: A critical vulnerability was found in Tongda OA, affecting the file general/hr/manage/staff reinstatement/delete.php. The manipulation of the REINSTATEMENT ID argument leads to SQL injection. The...

PT-2023-31486 · Lmxcms · Lmxcms

Name of the Vulnerable Software and Affected Versions: lmxcms versions up to 1.41 Description: A critical issue affects some unknown functionality of the file admin.php. The manipulation of the lid argument leads to SQL injection. The vendor was contacted about this disclosure but did not respond...

PT-2023-28328 · Zzcms +1 · Zzcms +1

Name of the Vulnerable Software and Affected Versions: zzCMS version 2023 Description: An issue in the software allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php. Recommendations: For zzCMS version 2023, consider...

PT-2023-21848 · Unknown · Freewill Ifis

Name of the Vulnerable Software and Affected Versions: Freewill iFIS aka SMART Trade version 20.01.01.04 Description: The issue allows OS Command Injection via shell metacharacters to a report page. Recommendations: For Freewill iFIS aka SMART Trade version 20.01.01.04, consider restricting acces...

PT-2023-30772 · Ncep · Ncep

Name of the Vulnerable Software and Affected Versions: Ncep versions prior to 20230914 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For version...

PT-2023-30546

Name of the Vulnerable Software and Affected Versions Movus versions prior to 20230913 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For versions...

PT-2023-25660 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: OPSWAT MetaDefender KIOSK version 4.6.1.9996 Description: An issue was discovered in OPSWAT MetaDefender KIOSK where built-in features of Windows, such as desktop shortcuts and narrator, can be abused for privilege escalation. Recommendations...

PT-2023-27546 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions SAP UI 754 through SAP UI 758 SAP NetWeaver AS ABAP versions SAP BASIS 702, SAP BASIS 731 Description: The issue allows an attacker to inject JavaScript code that can be executed in the web-application,...

PT-2023-27636 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.102 Description: The issue concerns a File Upload vulnerability. It is exploitable via the uploads/dede/module make.php endpoint. Recommendations: For DedeCMS version 5.7.102, consider restricting access to the...

PT-2023-27714 · Unknown · Schoolmate

Name of the Vulnerable Software and Affected Versions: Schoolmate version 1.3 Description: The issue concerns SQL Injection in the ValidateLogin.php file, specifically affecting the variable $username from the SESSION. Recommendations: For Schoolmate version 1.3, consider restricting access to th...

PT-2023-30859 · Ibos Oa · Ibos Oa

Name of the Vulnerable Software and Affected Versions: IBOS OA version 4.5.5 Description: A critical issue was found in IBOS OA, affecting an unknown part of the file ?r=dashboard/position/del. This issue leads to sql injection and can be initiated remotely. The exploit has been disclosed to the...

PT-2023-27983 · Jeecg · Jeecg

Name of the Vulnerable Software and Affected Versions: Jeecg versions up to 3.5.3 Description: The issue is an arbitrary file read vulnerability. It can be exploited via the interface "/testConnection". Recommendations: For versions up to 3.5.3, as a temporary workaround, consider restricting...

PT-2023-30853 · Sourcecodester · Sourcecodester Simple Membership System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Membership System version 1.0 Description: A critical issue was found in the file club edit query.php, where the manipulation of the club id argument leads to SQL injection. This can be initiated remotely. The issue has...

PT-2023-27706 · Skyworth · Skyworth

Name of the Vulnerable Software and Affected Versions: Skyworth version 3.0 Description: The issue allows attackers to perform a directory traversal via mounting the Udisk to /mnt/. This is due to a problem in the directory /system/bin/blkid. Recommendations: For Skyworth version 3.0, consider...

PT-2023-27989 · Unknown · Dairy Farm Shop Management System Using Php/Mysql

Name of the Vulnerable Software and Affected Versions: Dairy Farm Shop Management System Using PHP and MySQL version 1.1 Description: The Dairy Farm Shop Management System Using PHP and MySQL contains multiple SQL injection vulnerabilities in the Login function. These vulnerabilities are exploite...

PT-2023-4877 · Jscape · Jscape Mft Server

Name of the Vulnerable Software and Affected Versions: JSCAPE MFT Server versions prior to 2023.1.9 Description: The issue is related to unsafe deserialization in the JSCAPE MFT Server, which allows an attacker to execute arbitrary Java code, including OS commands, via its management interface...

PT-2023-27243 · Solarwinds · Serv-U

Name of the Vulnerable Software and Affected Versions: Serv-U versions 15.4 through 15.4 Hotfix 1 Description: A vulnerability has been identified that allows an actor to bypass multi-factor/two-factor authentication if exploited. The actor must have administrator-level access to Serv-U to perfor...

PT-2023-26096 · Unknown · Crypto Currency Tracker

Name of the Vulnerable Software and Affected Versions: Crypto Currency Tracker CCT versions prior to 9.5 Description: The issue is related to incorrect access control in the User Registration page, allowing unauthenticated attackers to register as an Admin account via a crafted POST request...

PT-2023-28176 · Jenkins · Jenkins Ivy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Ivy Plugin versions 2.5 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete disabled modules. Recommendations: For Jenkins Ivy Plugin versions 2.5 and earlier, update to a version later...

PT-2023-21193

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description A non-admin authenticated user could incorrectly create resources using the import charts feature. Recommendations For Apache Superset versions up to and including 2.1.0, update to...