Cross site scripting

A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Login System 1.0. Affected by this issue is some unknown functionality of the file add-user.php. The manipulation of the argument qr-code leads to cross site scripting. The attack may be launched...

CVE-2024-1111 SourceCodester QR Code Login System add-user.php cross site scripting

A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Login System 1.0. Affected by this issue is some unknown functionality of the file add-user.php. The manipulation of the argument qr-code leads to cross site scripting. The attack may be launched...

CVE-2024-1111: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Login System 1.0. Affected by this issue is some unknown functionality of the file add-user.php. The manipulation of the argument qr-code leads to cross site scripting. The attack may be launched...

CVE-2024-0479: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Taokeyun up to 1.0.5. It has been classified as critical. Affected is the function login of the file application/index/controller/m/User.php of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. It is possible to...

CVE-2023-7159 gopeak MasterLab User.php update unrestricted upload

A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. T...

CVE-2023-7147

CVE-2023-7147 affects gopeak MasterLab up to 3.3.10. The vulnerability is in the function base64ImageContent in app/ctrl/User.php; manipulation of the image argument allows unrestricted file upload and can be triggered remotely. No exploit details are provided in the documents. Remediation/status...

CVE-2023-7147: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 i...

PT-2023-32914 · Unknown · Gopeak Masterlab

Name of the Vulnerable Software and Affected Versions: gopeak MasterLab versions up to 3.3.10 Description: A critical issue has been found in the function add/update of the file app/ctrl/admin/User.php, where the manipulation of the avatar argument leads to unrestricted upload. This issue can be...

CVE-2023-7159: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. T...

Sql injection

A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manageuser.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The...

CVE-2023-6464: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument user leads to sql injection. The attack may be launched remotely...

CVE-2023-6462: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in SourceCodester User Registration and Login System 1.0. Affected is an unknown function of the file /endpoint/delete-user.php. The manipulation of the argument user leads to cross site scripting. It is possible to launch the attack...

CVE-2023-6463: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument firstname leads to cross site scripting. The attac...

CVE-2023-49030: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in32ns KLive v.2019-1-19 and before allows a remote attacker to obtain sensitive information via a crafted script to the web/user.php component...

PT-2023-31032 · Klive · Klive

Name of the Vulnerable Software and Affected Versions: 32ns KLive versions 2019-1-19 and earlier Description: The issue allows a remote attacker to obtain sensitive information via a crafted script to the "web/user.php" component. This is achieved through a SQL Injection attack, which enables the...

CVE-2023-43014

Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'firstname' and 'lastname' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents...

Sql injection

Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'firstname' and 'lastname' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents...

CVE-2023-43014

CVE-2023-43014 relates to Asset Management System v1.0 with an authenticated SQL Injection in the fields “first_name” and “last_name” on the user.php page. The underlying issue is improper input handling that enables an authenticated attacker to dump the database contents. Documented impact is hi...

CVE-2023-43014 Asset Management System v1.0 - Authenticated SQL Injection (SQLi)

Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'firstname' and 'lastname' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents...

CVE-2023-43014: Improper Neutralization of Special Elements used in an SQL Command

Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'firstname' and 'lastname' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents...