CVE-2024-44837

A cross-site scripting XSS vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user parameter...

CVE-2024-44837

The CVE-2024-44837 issue affects Drug v1.0, specifically the component \bean\Manager.java, where a crafted payload injected into the user parameter enables cross-site scripting (XSS) and execution of arbitrary web scripts/HTML. The vulnerability is described with a CVSS v3.1 base score of 5.4 (Me...

CVE-2024-44837

A cross-site scripting XSS vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user parameter...

API-ATTACK-SYSTEM 安全漏洞

API-ATTACK-SYSTEM is an attack tool from the individual developers at Vypor. A security vulnerability exists in API-ATTACK-SYSTEM version v.1.0, which originated from a vulnerability that allows remote attackers to execute arbitrary code via the user GET parameter...

CVE-2024-44808

An issue in Vypor Attack API System v.1.0 allows a remote attacker to execute arbitrary code via the user GET parameter...

CVE-2024-44808

The CVE-2024-44808 entry concerns Vypor Attack API System v1.0. The issue allows a remote attacker to execute arbitrary code through the user GET parameter, indicating a remote code execution flaw. Public documents identify affected software as Vypor Attack API System (v1.0) and describe the unde...

CVE-2024-43700

xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment...

PT-2024-38858 · Unknown · Blood Bank System

Name of the Vulnerable Software and Affected Versions: Blood Bank System version 1.0 Description: A critical vulnerability was found in the Blood Bank System. The issue affects an unknown function of the file /login.php of the component Login Page. The manipulation of the user argument leads to S...

itsourcecode E-Commerce Website SQL注入漏洞

itsourcecode E-Commerce Website is an e-commerce website of itsourcecode open source. A SQL injection vulnerability exists in itsourcecode E-Commerce Website version 1.0, which stems from improper handling of the parameter user and could lead to an SQL injection attack...

itsourcecode Project Expense Monitoring System 安全漏洞

itsourcecode Project Expense Monitoring System is a project expense monitoring system from itsourcecode. A security vulnerability exists in itsourcecode Project Expense Monitoring System version 1.0, which originates from an unknown function in the file login1.php of the component Backend Login,...

Authorization Bypass

directus is vulnerable to Authorization Bypass. The vulnerability is caused due to a missing validation for the user parameter in the PATCH requests for the end point /presets. This allows an authenticated external attacker to modify presets created by the same user to assign them to another user...

CVE-2024-6534 Directus 10.13.0 - Insecure object reference via PATH presets

Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with...

SourceCodester Online Graduate Tracer System 跨站脚本漏洞

SourceCodester Online Graduate Tracer System is a web-based application project developed by SourceCodester using PHP and MySQL database. Its main purpose is to provide a platform for a school to track their alumni and generate graphical reports on alumni status. A cross-site scripting...

SourceCodester Clinics Patient Management System SQL注入漏洞

SourceCodester Clinics Patient Management System is a clinic patient management system from SourceCodester, Inc. A SQL injection vulnerability exists in SourceCodester Clinics Patient Management System version 1.0, which stems from an incorrect manipulation of the parameter username that can lead...

PT-2024-38266 · Unknown · Itsourcecode Online Blood Bank Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Blood Bank Management System version 1.0 Description: A problematic issue was found in the itsourcecode Online Blood Bank Management System, affecting the User Registration Handler component, specifically the file...

Online Blood Bank Management System 跨站脚本漏洞

Online Blood Bank Management System is an online blood bank management system. Online Blood Bank Management System version 1.0 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by parameter user, which can be...

CVE-2024-40393

Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php...

ZKTeco BioTime Security Breach

ZKTeco BioTime is a powerful web-based time and attendance management software from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco BioTime version 9.5.2 and earlier versions, which is caused by a cross-site scripting vulnerability in the user parameter of system-group-add...

Simple Online Bidding System SQL Injection Vulnerability

Simple Online Bidding System is an online bidding system by oretnom23 individual developer. SourceCodester Simple Online Bidding System version 1.0 suffers from a SQL injection vulnerability that originates from the parameter id of the file /admin/ajax.php?action=deleteuser which can lead to SQL...

CVE-2024-6191

A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. This affects an unknown part of the file login.php of the component Login Page. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The...