670 matches found
CVE-2024-33818
CVE-2024-33818 concerns Globitel KSA SpeechLog v8.1, where an Insecure Direct Object Reference (IDOR) is exposed via the userID parameter. Multiple connected sources corroborate that the vulnerability exists in SpeechLog Analytics v8.1 and is triggered remotely (attack vector: network) with low c...
CVE-2024-33818
Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference IDOR via the userID parameter...
CVE-2024-31673
Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...
CVE-2024-31673
Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...
CVE-2024-31673
Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...
PT-2024-24185 · Unknown · Kliqqi-Cms
Name of the Vulnerable Software and Affected Versions: Kliqqi-CMS version 2.0.2 Description: The issue is related to SQL Injection in the load data.php file via the userid parameter. This allows for potential exploitation. Recommendations: For Kliqqi-CMS version 2.0.2, consider restricting access...
CVE-2024-31673
Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data.php via the userid parameter. Reported as CVE-2024-31673; CVSS 3.1 base score 9.8 (Network, Privileges NONE, User Interaction NONE; Confidentiality/Integrity/Availability: HIGH). Root cause: improper handling of the userid input enablin...
CVE-2024-31673
Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...
PT-2024-26384
Name of the Vulnerable Software and Affected Versions Campcodes Online Event Management System version 1.0 Description A critical issue has been discovered, affecting the /api/process.php file. The manipulation of the userId argument leads to sql injection, allowing remote attacks. The issue has...
CVE-2024-2645
A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb/resetpwd/resetpwd.php. The manipulation of the argument UserId leads to improper neutralization of data within xpath expressions. It is...
Netentsec NS-ASG Application Security Gateway Security Vulnerability
Netentsec NS-ASG Application Security Gateway is an application security gateway from China Netentsec. A security vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which originates from the parameter UserId in the file /vpnweb/resetpwd/resetpwd.php, which can lead...
PT-2024-21379 · Netentsec · Netentsec Ns-Asg Application Security Gateway
Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A problematic issue has been found in the Netentsec NS-ASG Application Security Gateway. This issue affects an unknown part of the file "/vpnweb/resetpwd/resetpwd.php". Th...
CVE-2023-6223 LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers,...
X (Formerly Twitter): Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS File
The vulnerability allowed the retrieval of a user's X username and user ID from a dynamically generated JavaScript file hosted on Twitter. An attacker could force a victim to import the file from a malicious website, bypassing the Same-Origin Policy and exposing the user's sensitive information...
CVE-2023-46980
An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter...
CVE-2023-46980
An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter...
CVE-2023-45826
Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...
Sql injection
Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...
