15468 matches found
CVE-2024-35475
A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...
CVE-2024-35475
A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...
CVE-2024-35475
A Cross-Site Request Forgery (CSRF) vulnerability exists in OpenKM Community Edition version 6.3.12 and earlier. The flaw is located in the /admin/DatabaseQuery endpoint, which allows an attacker to manipulate a victim with administrative privileges into executing arbitrary SQL commands . To reme...
CVE-2024-35475
A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...
CVE-2024-35475: Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...
PT-2024-26513
Name of the Vulnerable Software and Affected Versions OpenKM Community Edition versions 6.3.12 and earlier Description A Cross-Site Request Forgery CSRF issue was found in the "admin/DatabaseQuery" endpoint, allowing an attacker to manipulate a victim with administrative privileges into executing...
CVE-2024-34949: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function OrderLogic::getOrderList function, exploited at the /admin/order/lists.html endpoint...
CVE-2024-4893
DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands...
CVE-2024-4893 DigiWin EasyFlow .NET - SQL Injection
DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands...
Siemens RUGGEDCOM CROSSBOW SQL Injection Vulnerability (CNVD-2024-24515)
Siemens RUGGEDCOM CROSSBOW is a proven secure access management solution from Siemens, Germany. Siemens RUGGEDCOM CROSSBOW suffers from a SQL injection vulnerability that can be exploited by an attacker to send arbitrary SQL commands to a SQL server...
CVE-2024-27940
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.5. The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database...
CVE-2024-27940
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.5. The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database...
CVE-2024-34226: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in /php-sqlite-vms/?page=managevisitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters...
CVE-2024-34226
SQL injection vulnerability in /php-sqlite-vms/?page=managevisitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters...
CVE-2024-4801
CVE-2024-4801 affects Kashipara College Management System 1.0. The vulnerability is a SQL injection in the address parameter of submit_new_faculty.php, exploitable remotely, with public disclosure of exploits. Multiple sources confirm the affected component path and vulnerability class, and refer...
CVE-2024-31961
A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands via the level2 parameter...
CVE-2024-31961
A SQL injection vulnerability exists in the unit.php component of Sonic Shopfloor.guide versions prior to 3.1.3 . Remote attackers can exploit this flaw by providing malicious input via the level2 parameter to execute arbitrary SQL commands. This could lead to unauthorized data access or modifica...
CVE-2024-31961
A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands via the level2 parameter...
RuvarOA 安全漏洞
RuvarOA is an office automation system of Ruvar China. A security vulnerability exists in RuvarOA v6.01 and v12.01, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...