SAP KMC WPC 安全漏洞

SAP KMC WPC is a combination of enterprise content management and web publishing components from SAP. An information disclosure vulnerability exists in SAP KMC WPC, which can be exploited by an attacker to retrieve a user name via a simple parameter query, resulting in the disclosure of sensitive...

Gym Management System 注入漏洞

Gym Management System is a gym management system from SourceCodester. An injection vulnerability exists in Gym Management System version 1.0, which stems from an incorrect manipulation of the parameter username that can lead to SQL injection...

CVE-2025-2202

CVE-2025-2202 is a broken access control vulnerability in the Innovación y Cualificación local administration plugin’s ajax.php. Affected component: local administration plugin (ajax.php). Root cause: improper access control that permits an attacker to obtain sensitive user data (id, name, login,...

U.S. Dept Of Defense: Information Disclosure in API Endpoint /users

An endpoint /users was exposing sensitive user information, including id, first name, last name, email, role, and authdata, to unauthenticated users. This allowed anyone to retrieve private user details without authentication...

CVE-2025-22906

RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN...

CVE-2025-22916

RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function...

EDIMAX RE11S 安全漏洞

EDIMAX RE11S is a router from EDIMAX. A security vulnerability exists in EDIMAX RE11S v1.11 that originates from the discovery of a contained stack overflow via the pptpUserName parameter in the setWAN function...

EDIMAX RE11S 安全漏洞

EDIMAX RE11S is a router from EDIMAX. A security vulnerability exists in EDIMAX RE11S v1.11 that stems from the discovery of a contained stack overflow via the pppUserName parameter in the formPPPoESetup function...

1000 Projects Attendance Tracking Management System 安全漏洞

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. A security vulnerability exists in 1000 Projects Attendance Tracking Management System version 1.0, which stems from an incorrect operation of the parameter adminusername that...

1000 Projects Attendance Tracking Management System 注入漏洞

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. An injection vulnerability exists in 1000 Projects Attendance Tracking Management System version 1.0, which originates from the parameter adminusername in the file...

Sensitive Information Exposure

Moodle is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper error handling, allowing users with the "send message" capability to view the names of other users they should not have access to via an error message in the Messaging system...

The vulnerability of the microprogrammed software of the SCALANCE M-800 industrial routers is related to incorrect processing of user names, which allows a intruder to compromise the integrity of the system.

The vulnerability of the microprogramming software in industrial routers SCALANCE M-800 is related to incorrect processing of user names containing more than 15 characters. These names are completely ignored when accessing through SSH or Telnet. Exploiting this vulnerability can allow a hacker to...

WordPress plugin Yotpo: Product & Photo Reviews for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2024-39590 · Yotpo · Yotpo: Product & Photo Reviews For Woocommerce

Name of the Vulnerable Software and Affected Versions: Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress versions up to, and including, 1.7.8 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allo...

Malicious code in bytebs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 443278bc9421868cfa1431a267241ecb62582b57285a1d5f093d7109e2d12288 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Code-Projects Content Management System SQL注入漏洞

Code-Projects Content Management System is a Code-Projects open source content and management system. A SQL injection vulnerability exists in Code-Projects Content Management System version 1.0, which originates from a SQL injection of the parameter username...

PT-2024-32085 · Inroad · Inroad

Name of the Vulnerable Software and Affected Versions: INROAD versions prior to v202402060 Description: The issue concerns the API endpoint "/AccountMaster/GetCurrentUserInfo" where attackers can access sensitive information by sending a crafted payload to the UserNameOrPhoneNumber parameter. Thi...

CVE-2024-46559

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPAUsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2024-8471

Cross-Site Scripting XSS vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php...

CVE-2024-42769

A Reflected Cross Site Scripting XSS vulnerability was found in "/core/signupuser.php " of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "userfname" and "userlname" parameters...