Sql injection

Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=user/manageuser&id=...

Sql injection

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=deletefee...

Sql injection

Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/classes/Users.php?f=delete...

Sql injection

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=deletetransaction...

CVE-2022-29738

Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=transaction/send&id=, id...

CVE-2022-29738

CVE-2022-29738 affects Money Transfer Management System 1.0. Multiple connected sources confirm a SQL Injection vulnerability in the admin transaction endpoint: /mtms/admin/?page=transaction/send&id= (id parameter). Root cause is user-controlled input not properly sanitized, enabling arbitrary SQ...

CVE-2022-29739

Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=user/manageuser&id=...

CVE-2022-29739

CVE-2022-29739 affects Money Transfer Management System 1.0 with a SQL injection in the /mtms/admin/?page=user/manage_user&id= parameter. The vulnerability arises from improper input handling in the user-management query, enabling potentially unauthorized data access. Public documents consistentl...

CVE-2022-29741

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=deletefee...

CVE-2022-29741

CVE-2022-29741 affects Money Transfer Management System 1.0. The connected documents confirm a SQL Injection vulnerability in the application, exploitable via the request path m tms\classes\Master.php?f=delete_fee, which suggests improper input handling in the related database query. The referenc...

CVE-2022-29745

CVE-2022-29745 affects Money Transfer Management System 1.0 and is vulnerable to SQL injection in MTMS’s Master.php?f=delete_transaction. The connected records indicate: vulnerable component (Master.php delete_transaction), affected software (Money Transfer Management System 1.0), and impact per ...

CVE-2022-29745

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=deletetransaction...

CVE-2022-29746

CVE-2022-29746 affects Money Transfer Management System 1.0 and is exploitable via SQL injection at /mtms/classes/Users.php?f=delete. Connected sources consistently identify a SQL injection vulnerability in that endpoint, with NVD reporting CVSS2/7.5 (HIGH) and CVSS3.1/9.8 (CRITICAL). The affecte...

CVE-2022-29746

Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/classes/Users.php?f=delete...

CVE-2022-1650

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2...

Input validation

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2...

CVE-2022-1650

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2...

createVault() does not verify ERC20 token contract exists before transferring

Lines of code Vulnerability details Impact There are no checks to ensure the the vault.token contract exists when creating a vault. Token address are deterministic in the EVM and can be known ahead of time. As a result it is possible for a user to call createVault with token set to a ERC20 contra...

no-revert-on-transfer ERC20 tokens can be drained

Lines of code Vulnerability details Impact Some ERC20 tokens don't throw but just return false when a transfer fails. This can be abused to trick the createVault function to initialize the vault without providing any tokens. A good example of such a token is ZRX: Etherscan code When such a vault ...

Protocol does not support fee-on-transfer tokens

62 comment Warden: cmichel Protocol does not support fee-on-transfer tokens, see addLiquidity and LiquidityPool.depositErc20. The amount value is stored and available to be withdrawn later but the contract receives amount - fees. Note that there are tokenCheckstokenAddress and the protocol would...