ChurchCRM security vulnerabilities

ChurchCRM is an open source CRM system for churches. ChurchCRM 5.8.0 and prior versions suffer from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL commands t...

Online-Payroll-Management-System SQL injection vulnerability

Online-Payroll-Management-System is an online payroll management system by the individual developer MD MAFUJUL HASAN. A SQL injection vulnerability exists in Online-Payroll-Management-System version 20230911 and prior versions, which stems from an incorrect manipulation of the parameter id that c...

KB5006944 - Cumulative Update 27 for SQL Server 2017

KB5006944 - Cumulative Update 27 for SQL Server 2017 Release Date: October 27, 2021 Version: 14.0.3421.10 Summary This article describes Cumulative Update package 27 CU27 for Microsoft SQL Server 2017. This update contains 12 fixes that were issued after the release of SQL Server 2017 Cumulative...

ProSAFE Network Management System getFilterString Code Execution

The vulnerability of the getFilterString method in the ProSAFE Network Management System NMS300 microprogramming device lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Siemens RUGGEDCOM CROSSBOW SQL Injection

The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database...

RHUB TurboMeeting security vulnerability

RHUB TurboMeeting is a collaboration solution from RHUB Corp. It provides web conferencing, remote support, audio conferencing, video conferencing, remote access, and webinar support. A security vulnerability exists in RHUB TurboMeeting versions prior to 8.X. The vulnerability is caused by a remo...

Centreon testServiceExistence() Code Execution

The vulnerability of the testServiceExistence function in the Centreon IT infrastructure monitoring software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Arfa-CMS SQL Injection

The vulnerability of the Arfa-CMS content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2024-38773

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17...

CVE-2024-6967

A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been classified as critical. This affects an unknown part of the file /employeegatepass/admin/?page=employee/manageemployee. The manipulation of the argument id leads to sql injection. It is...

WordPress uipress-lite plugin <= 3.4.06 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Nguyễn Trung Kiên Patchstack Alliance in WordPress Plugin UiPress lite versions = 3.4.06...

CVE-2024-0857

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection. This issue affects FlexWater Corporate Water Management: before 5.452.0...

CVE-2024-40392

SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injection vulnerability via the name parameter under addnew.php...

PT-2024-5690 · Unknown · Netcat Cms

Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to the implementation of the subscribes delete confirm method in the comments module of the Netcat CMS system, which fails to take measures to protect the SQL query...

Apache Superset security vulnerabilities

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end database...

PT-2024-5669 · Unknown · Netcat Cms

Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to the implementation of the get component fields method in the comments module of the Netcat CMS system, which fails to take measures to protect the SQL query...

CVE-2024-40560

Tmalldemo before v2024.07.03 was discovered to contain a SQL injection vulnerability...

CVE-2024-6743

AguardNet's Space Management System does not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

Employee and Visitor Gate Pass Logging System SQL Injection Vulnerability

Employee and Visitor Gate Pass Logging System is an employee and visitor pass logging system developed by Carlo Montero, an individual developer. An SQL injection vulnerability exists in Employee and Visitor Gate Pass Logging System version 1.0, which stems from a parameter id in the file...

PT-2024-5175 · Unknown · Tailoring Management System

Name of the Vulnerable Software and Affected Versions: Tailoring Management System version 1.0 Description: The issue is related to a lack of protection against SQL query structure exploitation in the templateadd.php file. This allows a remote attacker to execute arbitrary SQL code, gain...