796 matches found
CVE-2023-39852
Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party who claims that the userid is a session variable controlled by the server, and thus cannot be used for exploitation. The original reporter...
CVE-2023-43270
dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...
CVE-2023-36100
An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser...
CVE-2023-34755
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user=edit...
CVE-2023-1557
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to...
CVE-2022-25228
CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings=show' via the 'userID' parameter, in '/index.php?m=candidates=show' via the 'candidateID', in '/index.php?m=joborders=show' via the 'jobOrderID' and '/index.php?m=companies=show' via the...
CVE-2022-43232
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /phpaction/fetchOrderData.php...
CVE-2022-43233
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /phpaction/fetchSelectedUser.php...
CVE-2010-2508
SQL injection vulnerability in user-profile.php in 2daybiz Video Community Portal Script allows remote attackers to execute arbitrary SQL commands via the userid parameter...
CVE-2013-3600
Coursemill Learning Management System LMS 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions...
CVE-2025-4863 Advaya Softech GEMS ERP Portal studentLogin.action sql injection
A vulnerability, which was classified as critical, was found in Advaya Softech GEMS ERP Portal 2.1. This affects an unknown part of the file /studentLogin/studentLogin.action. The manipulation of the argument userId leads to sql injection. It is possible to initiate the attack remotely. The explo...
CVE-2025-4863
Summary: CVE-2025-4863 affects Advaya Softech GEMS ERP Portal 2.1, targeting the /studentLogin/studentLogin.action endpoint. The vulnerability arises from manipulation of the userId parameter, enabling SQL injection and remote initiation. Public disclosures and PoC materials exist (e.g., GEMS_POC...
CVE-2025-4863 Advaya Softech GEMS ERP Portal studentLogin.action sql injection
A vulnerability, which was classified as critical, was found in Advaya Softech GEMS ERP Portal 2.1. This affects an unknown part of the file /studentLogin/studentLogin.action. The manipulation of the argument userId leads to sql injection. It is possible to initiate the attack remotely. The explo...
CVE-2025-4863: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in Advaya Softech GEMS ERP Portal 2.1. This affects an unknown part of the file /studentLogin/studentLogin.action. The manipulation of the argument userId leads to sql injection. It is possible to initiate the attack remotely. The explo...
Advaya Softech GEMS ERP Portal 注入漏洞
Advaya Softech GEMS ERP Portal is an enterprise resource planning ERP portal system from Advaya Softech India that provides enterprise-level business process management, financial management, and supply chain integration capabilities. An injection vulnerability exists in Advaya Softech GEMS ERP...
CVE-2023-34732
An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force attacks to discover user passwords...
CVE-2023-34732: Improper Restriction of Excessive Authentication Attempts
An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force attacks to discover user passwords...
CVE-2023-34732
The Flytxt NEON-dX software (specifically version v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c ) contains an Authenticated Function Abuse vulnerability. The change password function relies on the userId parameter instead of the authenticated session or token, allowing an attacker to brute-force other user...
Flytxt NEON-dX 安全漏洞
Flytxt NEON-dX is an enterprise software product from Flytxt for automating intelligent digital customer interactions. A security vulnerability exists in Flytxt NEON-dX that stems from an unvalidated userId parameter in the change password function, which could lead to a brute force attack...
