CVE-2020-22165

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22166

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\forgot-password.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22168

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22168

CVE-2020-22168 concerns the PHPGurukul Hospital Management System v4.0, where a SQL injection exists in the file hms/change-emaild.php. The vulnerability allows remote, unauthenticated attackers to extract sensitive data from the database. Several connected sources corroborate the existence of a ...

CVE-2020-22171

PHPGurukul Hospital Management System v4.0 is affected by a SQL injection in hms\registration.php, exploitable by remote unauthenticated users to obtain sensitive DB information. Multiple sources corroborate the vulnerability in PHPGurukul Hospital Management System 4.0. Exploitation details are ...

CVE-2020-22171

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\registration.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22172

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\getdoctor.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22173

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\edit-profile.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22174

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\book-appointment.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

CVE-2020-22175

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\admin\betweendates-detailsreports.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

GHSA-FH37-CX83-Q542 Improper Authentication in Apache Airflow

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can jus...

Intel Server Board M10JNP2SB Advisory (INTEL-SA-00474)

The version of the Intel BIOS on the remote device is affected by multiple vulnerabilities, as follows: - Buffer overflow in the BMC firmware for IntelR Server Board M10JNP2SB before version EFI BIOS 7215, BMC 8100.01.08 may allow an unauthenticated user to potentially enable an escalation of...

CVE-2021-24351

The theplusmorepost AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting exploitable on both unauthenticated and authenticated users...

CVE-2021-24352

The exportdata function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects...

Design/Logic Flaw

The importdata function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects...

CVE-2021-24352 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export

The exportdata function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects...

CVE-2021-24353

The CVE-2021-24353 entry concerns the WordPress plugin Simple 301 Redirects by BetterLinks, versions before 2.0.4. The issue is in import_data, which lacks capability and nonce checks, permitting unauthenticated users to import a set of site redirects. This aligns with the cited NVD/Red Hat/CVE r...

CVE-2021-24352

The CVE-2021-24352 concerns the WordPress plugin Simple 301 Redirects by BetterLinks. Affected versions before 2.0.4 (notably 2.0.0–2.0.3) expose the export_data function which lacks capability/nonce checks, allowing unauthenticated users to export a site's redirects. This represents an unauthent...

CVE-2020-15377

Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery SSRF...

Advanced AJAX Product Filters < 1.5.4.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The braapfgetchild AJAX action of the plugin, available to both unauthenticated and authenticated users does not sanitise the 'termid' POST parameter before outputting it in the page, leading to reflected Cross-Site Scripting issue. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...