PT-2024-11747 · Siklu · Siklu Tg Terragraph

Name of the Vulnerable Software and Affected Versions: Siklu TG Terragraph devices versions prior to 2.1.1 Description: The issue allows attackers to discover valid, randomly generated credentials via the GetCredentials endpoint. This can potentially lead to unauthorized access. Recommendations:...

PT-2024-13449 · Tenda · Tenda Ax12 +3

Name of the Vulnerable Software and Affected Versions: Tenda TX9 V1 version 22.03.02.54 Tenda AX3 V3 version 16.03.12.11 Tenda AX9 V1 version 22.03.01.46 Tenda AX12 V1 version 22.03.01.46 Description: An access control issue in /usr/sbin/httpd allows attackers to bypass authentication on any...

PT-2024-20831 · Unknown · Task Manager App

Name of the Vulnerable Software and Affected Versions: Task Manager App version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the taskID parameter at the "/TaskManager/EditTask.php" API endpoint. Recommendations: For Task Manager A...

PT-2024-20320 · Zentao · Zentao

Name of the Vulnerable Software and Affected Versions: Zentao versions 18.0 through 18.10 Description: A remote code execution issue was discovered in Zentao, affecting its checkConnection method. The vulnerability can be exploited via the /app/zentao/module/repo/model.php endpoint, allowing for...

PT-2023-32791 · Kalcaddle · Kodexplorer

Name of the Vulnerable Software and Affected Versions: kalcaddle KodExplorer versions up to 4.51.03 Description: A critical issue affects the API Endpoint Handler component, specifically the /index.php?pluginApp/to/yzOffice/getFile file. The manipulation of the path/file argument leads to...

PT-2023-25204 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS versions prior to 1.11.20 Description: The issue concerns a path traversal vulnerability in the file upload functionality, specifically in the /main/webservices/additional webservices.php endpoint. This allows unauthenticated...

PT-2023-32940

Name of the Vulnerable Software and Affected Versions encoded id-rails versions before 1.0.0.beta2 Description The issue is an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an...

PT-2023-27875 · Plixer · Plixer Scrutinizer

Name of the Vulnerable Software and Affected Versions: Plixer Scrutinizer versions prior to 19.3.1 Description: An issue was discovered in the /fcgi/scrut fcgi.fcgi endpoint, specifically in the csvExportReport endpoint action generateCSV, which is vulnerable to SQL injection through the sorting...

PT-2023-24413 · H3C · H3C Magic R300

Name of the Vulnerable Software and Affected Versions: H3C Magic R300 version R300-2100MV100R004 Description: A stack overflow issue was discovered in the DelvsList interface at the "/goform/aspForm" API endpoint. This issue can be exploited, potentially allowing unauthorized access or control...

PT-2023-22785 · Archery · Archery

Name of the Vulnerable Software and Affected Versions: Archery affected versions not specified Description: The Archery project contains multiple SQL injection vulnerabilities that may allow an attacker to query the connected databases. User input coming from the db name in the sql/data...

PT-2023-17114 · Zhong Bang · Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB Java versions up to 1.3.4 Description: A critical issue affects the function getAdminList of the file "/api/admin/store/product/list". The manipulation of the argument cateId leads to sql injection. The attack can be initiate...

PT-2023-16983 · Sourcecodester · Sourcecodester Medicine Tracker System

Name of the Vulnerable Software and Affected Versions: SourceCodester Medicine Tracker System version 1.0 Description: A critical issue has been found in the processing of the file medicines/view details.php of the component GET Parameter Handler. The manipulation of the GET argument leads to sql...

PT-2023-1609 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 4.4.2 Patch Level 1 and earlier Description: The issue is related to a YAML deserialization flaw, allowing a remote attacker to execute arbitrary code on the system by sending a specially crafted obsolete API call...

PT-2023-18598 · Unknown · Izybat Orange Casiers

Name of the Vulnerable Software and Affected Versions: IzyBat Orange casiers versions before 20221102 1 Description: The issue allows SQL Injection via a "getCasier.php?taille=" URI. Recommendations: For versions before 20221102 1, update to a version 20221102 1 or later to resolve the issue. As ...

PT-2023-18509 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 3.0.0.beta16 on the beta and tests-passed branches Description: The issue exposes the number of times a user posted in an arbitrary topic to unauthorized user...

PT-2022-27781 · Unknown · Spring-Boot-Admin

Name of the Vulnerable Software and Affected Versions: Spring Boot Admin versions prior to 2.6.10 Spring Boot Admin versions prior to 2.7.8 Description: The issue affects users who run Spring Boot Admin Server with enabled Notifiers and write access to environment variables via UI. This allows fo...

PT-2022-26293 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version 15.03.06.23 Description: The issue is related to a stack overflow vulnerability. This vulnerability can be exploited via the "/goform/formSetFirewallCfg" API endpoint. Recommendations: For Tenda AC10 version 15.03.06.23, as...

PT-2022-24571 · Zaver · Zaver

Name of the Vulnerable Software and Affected Versions: Zaver versions through 2020-12-15 Description: The issue allows directory traversal via the GET /.. substring. This can be exploited through the "GET /.. substring" API endpoint. Recommendations: For versions through 2020-12-15, consider...

PT-2022-18389 · Unknown · Zoo Management System

Name of the Vulnerable Software and Affected Versions: Zoo Management System version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability. This is possible through the "/public html/apply vacancy" API...

PT-2021-11130 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig versions 3.9.5 Description: An arbitrary file deletion issue allows attackers to delete files by sending a crafted request to "/lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php" and specifying a path in the path parameter and an extensi...