Exploit for SQL Injection in Phpgurukul Online_Shopping_Portal

CVE-2023-38890 Description Online Shopping Portal Project...

CVE-2023-38890: Improper Neutralization of Special Elements used in an SQL Command

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...

CVE-2023-3267

When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with...

CVE-2023-3267

When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with...

CVE-2023-38951

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 20240617.19506 allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH...

CVE-2023-38951

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 20240617.19506 allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH...

CVE-2023-38951: Improper Limitation of a Pathname to a Restricted Directory

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 20240617.19506 allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH...

Sql injection

Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page...

CVE-2023-34635: Improper Neutralization of Special Elements used in an SQL Command

Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page...

GZ Scripts Vacation Rental Website 跨站脚本漏洞

GZScripts is a script from GZScripts, Inc. A cross-site scripting vulnerability exists in GZ Scripts Vacation Rental Website version 1.8, which stems from the parameter username/title/comment in the file /VacationRentalWebsite/property/8/ad-has-principes/ that can result in cross-site scripting...

CVE-2023-37308

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...

CVE-2023-37308

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...

CVE-2023-37308

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...

Zoho ManageEngine ADAudit Plus 跨站脚本漏洞

ZOHO ManageEngine ADAudit Plus is used by ZOHO to simplify auditing, prove compliance and detect threats. A security vulnerability exists in Zoho ManageEngine ADAudit Plus prior to version 7100 that stems from a cross-site scripting attack via the username field...

CVE-2023-37308

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...

CVE-2023-37308

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...

CVE-2023-37308: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...

CVE-2023-30319

Cross Site Scripting XSS vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code...

CVE-2023-30319

Cross Site Scripting XSS vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code...

CVE-2023-30319

Cross Site Scripting XSS vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code...