CVE-2022-32170: Improper Authorization

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=$userId”...

CVE-2022-26959

There are two full read/write Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp pag...

PT-2022-18141

Name of the Vulnerable Software and Affected Versions Northstar Club Management version 6.3 Description The issue concerns two Blind/Time-based SQL injection vulnerabilities. These exist in the userName parameter of the "processlogin.jsp" page in the "/northstar/Portal/" directory and the userID...

CVE-2022-25228

CVE-2022-25228 : Affected software is CandidATS 3.0.0 Beta. An authenticated user can inject SQL via parameters on several endpoints: /index.php?m=settings&a=show (userID), /index.php?m=candidates&a=show (candidateID), /index.php?m=joborders&a=show (jobOrderID), and /index.php?m=companies&a=show ...

CVE-2022-25228: Improper Neutralization of Special Elements used in an SQL Command

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via...

CVE-2021-42943

Stored cross-site scripting XSS in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter...

CVE-2021-42943

Stored cross-site scripting XSS in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter...

CVE-2021-42943

Stored cross-site scripting XSS in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter...

MetalGenix GeniXCMS vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the 1 email parameter or 2 userid parameter to register.php...

PT-2022-11747

Name of the Vulnerable Software and Affected Versions IPPlan version 4.92b Description The issue allows remote attackers to inject arbitrary web script or HTML via the userid parameter in the "admin/usermanager.php" endpoint. This enables attackers to perform stored cross-site scripting XSS...

CVE-2021-42943: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter...

IPPlan 跨站脚本漏洞

IPPlan is a web-based multilingual TCP IP address management IPAM software and tracking tool. Simplifying the management of the IP address space, IPPlan version 4.92b is vulnerable to a cross-site scripting vulnerability, which stems from a cross-site scripting XSS vulnerability found in...

Security Bulletin: IBM Flex System Manger expired USERID password vulnerability (CVE-2013-5424)

Summary Abstract Security Bulletin: IBM Flex System Manger expired USERID password vulnerability CVE-2013-5424 Content Vulnerability Details: CVE ID: CVE-2013-5424. Description: All affected versions of the Flex System Manager FSM are vulne Vulnerability Details Abstract Security Bulletin: IBM Fl...

Moodle allows remote authenticated users to reassign notes

notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified 1 userid or 2 courseid field...

Sourcecodester Baby Care System SQL注入漏洞（CNVD-2022-35520）

Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 is vulnerable to SQL injection, which originates from /admin/uesrs.php & action=type & userrole=User & userid= in the userid parameter missing validation of...

CVE-2022-28438

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=...

CVE-2022-28436

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Hide&userid=...

CVE-2022-28437

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3...

CVE-2022-28437

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3...

CVE-2022-28437: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3...