CVE-2020-21176

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter...

CVE-2020-21176

CVE-2020-21176 describes an SQL injection in ThinkJS 3.2.10. The affected components are the functions model.increment and model.decrement, where user-supplied input via the step parameter can be used to craft and execute arbitrary SQL commands on the backend. The vulnerability enables unauthenti...

ThinkJS SQL注入漏洞

ThinkJS is a Node.js framework for future-proof development that integrates a wide range of project best practices to make enterprise-level development easier and more efficient. A SQL injection vulnerability exists in the model.increment and model.decrease functions in ThinkJS 3.2.10. A remote...

CMSWing SQL注入漏洞

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. A code execution vulnerability exists in CMSWing 1.3.8. The vulnerability stems from the log function not checking the log parameter. An attacker can exploit this vulnerability to execute arbitrary commands via malicious parameters...

SQL Injection Vulnerability in CMSWing of Xi'an Huashang Software Technology Co.(CNVD-2020-48681)

CMSWING is a ThinkJS-based e-commerce platform and CMS builder. Xi'an Huashang Software Technology Co., Ltd CMSWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in CmsWing

CMSWING is a powerful e-commerce platform and CMS builder based on ThinkJS. CmsWing suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

CMSWing Weak Encryption Algorithm Vulnerability

CMSWing is a powerful e-commerce platform and CMS builder based on ThinkJS PC, mobile and WeChat public platform. A weak encryption algorithm vulnerability exists in the global.encryptPassword function of bootstrap/global.js in CMSWing 1.3.7, which can be exploited by an attacker to brute-force...