CVE-2022-39370: Improper Access Control

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been...

CVE-2022-39370

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been...

PT-2022-11824

Name of the Vulnerable Software and Affected Versions Mumara Classic versions through 2.93 Description A SQL injection issue in the license update.php file allows a remote unauthenticated attacker to execute arbitrary SQL commands via the license parameter. This enables the attacker to manipulate...

Sql injection

Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php...

CVE-2022-35422

CVE-2022-35422 affects Web Based Quiz System v1.0, with a SQL injection via the qid parameter in update.php. The Red/European and vendor-related entries confirm the vulnerability is in the web app and involves the qid input being used in a SQL query, leading to potential data exposure or modifica...

CVE-2022-35422: Improper Neutralization of Special Elements used in an SQL Command

Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php...

PT-2021-11802

Name of the Vulnerable Software and Affected Versions: MantisBT versions through 2.24.3 Description: An issue was discovered where the custom field name in the helper ensure confirmed call in manage custom field update.php is not sanitized. This may be problematic depending on Content Security...

CVE-2020-23653

An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution...

CVE-2020-23653: Deserialization of Untrusted Data

An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php, which may lead to arbitrary remote code execution...

Code injection

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources...

CVE-2014-8937

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources...

CVE-2014-8937

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources...

CVE-2014-8937

The CVE-2014-8937 entry concerns Lexiglot (PHP-based translation platform) up to version released 2014-11-20. The vulnerability stems from api/update.php performing svn update operations that consume substantial server resources, leading to denial of service. The connected documents confirm the c...

PT-2020-7760

Name of the Vulnerable Software and Affected Versions Lexiglot versions through 2014-11-20 Description The issue allows for denial of service because the "api/update.php" endpoint launches svn update operations that use a great deal of resources. Recommendations For versions through 2014-11-20,...

CVE-2014-8937: Uncontrolled Resource Consumption

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources...

PT-2019-14780

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.6 Description The issue is related to stored XSS in the admin/infoclass update.php file. Recommendations For PHPMyWind version 5.6, update the admin/infoclass update.php file to properly sanitize user input and prevent XSS...

CVE-2018-12622

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

CVE-2018-12622

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

CVE-2018-12622

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

CVE-2018-12622

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...