SiempreCMS SQL injection vulnerability

SiempreCMS is a content management system of SiempreCMS open source. SiempreCMS 1.3.6 and earlier versions have a SQL injection vulnerability that stems from incorrect manipulation of the parameter name/userName in the file usersearchajax.php resulting in SQL injection...

Modern Bag login-back.php File SQL Injection Vulnerability

Modern Bag is an online management system. Modern Bag suffers from a SQL injection vulnerability that stems from an error in the parameter user-name in file /admin/login-back.php that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute...

Code-Projects Modern Bag Injection Vulnerabilities

Modern Bag is an online management system. Modern Bag suffers from a SQL injection vulnerability that stems from an error in the parameter user-name in file /admin/login-back.php that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute...

CVE-2023-26959

Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter...

Gym Management System injection vulnerability

Gym Management System is a gym management system from SourceCodester. An injection vulnerability exists in Gym Management System version 1.0, which stems from an incorrect manipulation of the parameter username that can lead to SQL injection...

WordPress plugin Yotpo: Product & Photo Reviews for WooCommerce Cross-site Scripting Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Code-Projects Content Management System SQL Injection Vulnerability

Code-Projects Content Management System is a Code-Projects open source content and management system. A SQL injection vulnerability exists in Code-Projects Content Management System version 1.0, which originates from a SQL injection of the parameter username...

CVE-2024-46559

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPAUsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2024-8471

Cross-Site Scripting XSS vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php...

WordPress plugin BuddyPress has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-28655 · WordPress · Buddypress

Name of the Vulnerable Software and Affected Versions: BuddyPress plugin for WordPress versions up to and including 12.4.0 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level permissions and above to inject...

PT-2024-20557 · Unknown · Bradwenqiang Hr

Name of the Vulnerable Software and Affected Versions: BradWenqiang HR version 2.0 Description: A critical issue affects the selectAll function of the /bishe/register file in the Background Management component. The manipulation of the userName argument leads to SQL injection. This issue can be...

CVE-2023-3260

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the user-name URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system...

Command injection

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the user-name URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system...

PT-2023-23903 · Dataprobe · Dataprobe Iboot Pdu

Name of the Vulnerable Software and Affected Versions: Dataprobe iBoot PDU versions 1.43.03312023 or earlier Description: The issue concerns command injection via the user-name URL parameter. An authenticated malicious agent can exploit this to execute arbitrary commands on the underlying Linux...

CVE-2023-26959

Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter...

CVE-2023-26959

Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter...

CVE-2023-26959: Improper Neutralization of Special Elements used in an SQL Command

Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter...

PT-2023-20877 · Unknown · Phpgurukul Park Ticketing Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Park Ticketing Management System version 1.0 Description: The issue is related to SQL Injection via the User Name parameter. This allows for potential exploitation. No information is provided about the estimated number of potential...

PHPgurukul Park Ticketing Management System SQL Injection Vulnerability

PHPGurukul Park Ticketing Management System is a park ticketing management system from PHPGurukul, Inc. A security vulnerability exists in version 1.0 of the Phpgurukul Park Ticketing Management System, which stems from a discovery containing a SQL injection attack via the User Name parameter...