PT-2024-41122

Уязвимость средства виртуализации VMmanager 6 связанная с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнять произвольные SQL-запросы к базе данных...

WordPress plugin WP ERP Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-39677 NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities

NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes mappings using inheritance with discriminator values; HQL...

PT-2024-5129

Name of the Vulnerable Software and Affected Versions: Arfa-CMS affected versions not specified Description: The issue is related to the lack of protection measures for the SQL query structure in Arfa-CMS, allowing a remote attacker to execute arbitrary SQL queries. Recommendations: At the moment...

PT-2024-5053

Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions 2.6.5 and earlier Description: The issue is related to a lack of protection against SQL query structure exploitation, allowing a remote attacker to execute arbitrary SQL queries. This occurs when the web application fai...

SEMCMS_Download.php SQL Injection Unauthorized Access

The vulnerability of the SEMCMSDownload.php script of the website management system for SemCms foreign trade enterprises is related to the lack of measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries and gain unauthorized...

Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ConfigurationServlet servlet, which listens on TCP port 8080 by default. Whe...

PT-2024-37101 · Centreon · Centreon

Name of the Vulnerable Software and Affected Versions: Centreon affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this issue. The specific flaw exists within the...

CVE-2024-36673

CVE-2024-36673 affects Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0. The vulnerability is an SQL Injection in login.php caused by inadequate validation of the email and password inputs, enabling injection of malicious SQL queries. Documented impact is high for confidentiality, i...

SOPlanning CMS System SQL Injection

The vulnerability of the projets.php script within the SOPlanning CMS system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Ivanti Endpoint Manager GetRulesetsSQL SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetRulesetsSQL method. The issue results from the lack of proper validation of a...

Ivanti Endpoint Manager GetLogFileRulesNameUniqueSQL SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetLogFileRulesNameUniqueSQL method. The issue results from the lack of proper...

Ivanti Endpoint Manager RecordBrokenApp SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the RecordBrokenApp method. The issue results from the lac...

Information Disclosure

neos/flow is vulnerable to Information Disclosure. The vulnerability is due to entity security not properly integrating with the doctrine query cache, allowing users to reuse cached SQL queries built for other users based on their roles rather than their specific properties, potentially revealing...

CVE-2024-3750

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData function in all versions up to, and including, 3.10.15. This makes it possible for authenticated...

CVE-2024-3750

CVE-2024-3750 affects Visualizer: Tables and Charts Manager for WordPress. Root cause: missing capability check in getQueryData() across all versions up to 3.10.15, enabling authenticated users with subscriber-level access and above to run arbitrary SQL queries, with potential privilege escalatio...

CVE-2024-3750: Missing Authorization

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData function in all versions up to, and including, 3.10.15. This makes it possible for authenticated...

PT-2024-8752

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.5 Description The issue is related to the lack of protection against SQL query structure manipulation. This allows a remote attacker to execute arbitrary SQL queries. The affected systems permit any...

RHEL 7 : mariadb (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mariadb: CONNECT storage engine heap-based buffer overflow CVE-2022-24052 - getsortbytable in MariaDB...

CVE-2023-51595

Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The...