1061 matches found
SQL Injection
github.com/navidrome/navidrome is vulnerable to SQL Injection. The vulnerability is due to the lack of proper input validation and escaping of URL parameters in SQL queries, allowing attackers to inject malicious SQL code into the application...
CVE-2024-47062 Multiple SQL Injections and ORM Leak in navidrome
Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not...
CVE-2024-47062
Navidrome (
GHSA-58VJ-CV5W-V4V6 Navidrome has Multiple SQL Injections and ORM Leak
Security Advisory: Multiple Vulnerabilities in Navidrome Summary Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not properly...
Navidrome has Multiple SQL Injections and ORM Leak
Security Advisory: Multiple Vulnerabilities in Navidrome Summary Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not properly...
CVE-2024-5416
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied...
CVE-2024-41572
Learning with Texts LWT 2.0.3 is vulnerable to Cross Site Scripting XSS. The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user...
CVE-2024-41572
Learning with Texts LWT 2.0.3 is vulnerable to Cross Site Scripting XSS. The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user...
PT-2024-29449
Name of the Vulnerable Software and Affected Versions Learning with Texts LWT version 2.0.3 Description The issue is related to Cross Site Scripting XSS, where the application fails to filter special characters in URL parameters, allowing remote attackers to inject JavaScript code without...
CVE-2024-41572: Improper Neutralization of Input During Web Page Generation
Learning with Texts LWT 2.0.3 is vulnerable to Cross Site Scripting XSS. The application has a specific function that does not filter special characters in URL parameters. Remote attackers can inject JavaScript code without authorization. Exploiting this vulnerability, attackers can steal user...
PT-2024-13693 · Apache · Apache Seatunnel
Name of the Vulnerable Software and Affected Versions: Apache SeaTunnel version 1.0.0 Description: A security issue in Apache SeaTunnel allows attackers to read files on the MySQL server by modifying the information in the MySQL URL. The issue can be exploited by setting specific parameters in th...
CVE-2024-41572
CVE-2024-41572 affects Learning with Texts (LWT) 2.0.3. The root cause is a function that does not filter special characters in URL parameters, enabling remote attackers to perform Cross Site Scripting (XSS). The vulnerability allows attackers to inject JavaScript, potentially stealing user crede...
CVE-2024-3938
The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a...
CVE-2024-3938
The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a...
CVE-2024-3938: Improper Input Validation
The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a...
Insecure Direct Object Reference (IDOR)
github.com/drakkan/sftpgo is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to the lack of proper security measures such as JWT ID JTI claims, nonces, and proper expiration and invalidation mechanisms. The vulnerability allows an attacker with a valid intercepted...
PT-2024-5102 · Apache · Apache Linkis
Name of the Vulnerable Software and Affected Versions: Apache Linkis versions =1.5.0 Description: The issue is related to the lack of effective filtering of parameters in the DataSource Manager Module of Apache Linkis. This allows an attacker to configure malicious db2 parameters, resulting in jn...
Hanwha Vision NVR Remote Code Execution (CVE-2023-6116)
An attacker could inject arbitrary attack code by manipulating http url parameters. However, in order to succeed in the attack, the base address of the stack memory must be obtained. The default address depends on firmware version, configuration option information, and the attack is unlikely to...
WordPress Plugin Grey Opaque Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in...
Information Disclosure
SonarQube is vulnerable to exposure of encrypted values in cleartext. The vulnerability is due to encrypted values generated using the Settings Encryption feature being exposed in URL parameters in logs, allowing attackers with access to SonarQube logs or proxy logs to view sensitive information...