School Dormitory Management System SQL Injection Vulnerability (CNVD-2022-66687)

School Dormitory Management System is a school dormitory management system. SQL injection vulnerability exists in School Dormitory Management System v1.0, which originates from /dms/admin/reports/dailycollection The report.php parameter lacks validation for external input SQL statements. An...

ChatBot Application with a Suggestion Feature SQL注入漏洞

ChatBot Application with a Suggestion Feature is a ChatBot application with a suggestion feature. chatBot Application with a Suggestion Feature version 1.0 is vulnerable to a SQL injection vulnerability that originates in /simple chatbot/admin/responses/viewresponse.php with an id parameter that...

Calibre-Web SQL Injection Vulnerability

Calibre-Web is a Web application for browsing, reading and downloading eBooks from the Calibre database.A SQL injection vulnerability exists in versions prior to Calibre-Web 0.6.18.The vulnerability stems from the application's lack of validation of externally entered SQL statements, which can be...

CVE-2022-1358

The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate and dump all data held in the cnMaestro database...

powermail extension for TYPO3 vulnerable to SQL Injection

SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

GHSA-RP53-FW29-RXG3 powermail extension for TYPO3 vulnerable to SQL Injection

SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

GHSA-69VW-JFQ7-935G PyWebDAV SQL Injection vulnerability

Multiple SQL injection vulnerabilities in the getuserinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the 1 user or 2 pw argument. NOTE: some of these details are obtained from third party...

PyWebDAV SQL Injection vulnerability

Multiple SQL injection vulnerabilities in the getuserinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the 1 user or 2 pw argument. NOTE: some of these details are obtained from third party...

GHSA-9GGP-5RF4-X7Q9 Fat Free CRM vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in app/controllers/homecontroller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the homepage timeline feature or 2 the activity feature...

GHSA-F3V6-G4MV-PJHQ WEC Map (wec_map) extension for TYPO3 allows SQL Injection

SQL injection vulnerability in the WEC Map wecmap extension before 3.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Apache Jetspeed vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...

Zend Framework SQL injection vector using null byte for PDO

The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query...

GeniXCMS SQL injection vulnerability

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activation parameter...

GHSA-GJCJ-FJ23-5J5V GeniXCMS SQL injection vulnerability

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activation parameter...

GHSA-R64J-5W3W-FP49 TeamPass vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

TeamPass vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

News system (news) extension for TYPO3 vulnerable to SQL Injection

SQL injection vulnerability in the News system news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

GHSA-JJGQ-JQ8G-24W4 Dolibarr SQL injection vulnerability in don/list.php

SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter...

GHSA-QM8M-7626-762H Dolibarr SQL injection vulnerability in admin/menus/edit.php

SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter...

Dolibarr SQL injection vulnerability in don/list.php

SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter...