PT-2023-26779

Name of the Vulnerable Software and Affected Versions ZeroWdd studentmanager version 1.0 Description The issue allows a remote attacker to execute arbitrary code via the username parameter in the student list function. This is a Cross Site Scripting vulnerability. Recommendations For ZeroWdd...

CVE-2023-39094: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student list function...

CVE-2023-38890

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...

Exploit for SQL Injection in Phpgurukul Online_Shopping_Portal

CVE-2023-38890 Description Online Shopping Portal Project...

Online Shopping Portal SQL Injection Vulnerability

Online Shopping Portal is an open source online shopping portal from the individual developer Anuj Kumar. A security vulnerability exists in Online Shopping Portal Project version 3.1, which stems from insufficient validation of user input provided in the username field, leading to an SQL injecti...

CVE-2023-38890: Improper Neutralization of Special Elements used in an SQL Command

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...

CVE-2023-38861

An issue in Wavlink WLWNJ575A3 v.R75A3V1410220513 allows a remote attacker to execute arbitrary code via username parameter of the setsysadm function in adm.cgi...

Code injection

An issue in Wavlink WLWNJ575A3 v.R75A3V1410220513 allows a remote attacker to execute arbitrary code via username parameter of the setsysadm function in adm.cgi...

CVE-2023-38889

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroupsjava.lang.String...

CVE-2023-38889

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroupsjava.lang.String...

Design/Logic Flaw

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroupsjava.lang.String...

CVE-2023-38889

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroupsjava.lang.String...

CVE-2023-38861

CVE-2023-38861 affects WAVLINK WL-WNJ575A3 (firmware v.R75A3_V1410_220513). The issue is a command injection in the adm.cgi function set_sys_adm, triggered by the username parameter, enabling a remote attacker to execute arbitrary code. The vulnerability is driven by improper input handling in th...

CVE-2023-38861

An issue in Wavlink WLWNJ575A3 v.R75A3V1410220513 allows a remote attacker to execute arbitrary code via username parameter of the setsysadm function in adm.cgi...

CVE-2023-38861: Improper Neutralization of Special Elements used in a Command

An issue in Wavlink WLWNJ575A3 v.R75A3V1410220513 allows a remote attacker to execute arbitrary code via username parameter of the setsysadm function in adm.cgi...

CVE-2023-38889: Improper Control of Generation of Code

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroupsjava.lang.String...

PT-2023-27132

Name of the Vulnerable Software and Affected Versions Pikachu version 1.0 Description The issue is a SQL injection vulnerability via the username parameter at incfunction.php. This allows for potential exploitation. No information is provided about the estimated number of potentially affected...

PT-2023-26669

Name of the Vulnerable Software and Affected Versions Alluxio versions 2.9.3 and earlier Description An issue in Alluxio allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroupsjava.lang.String. This enables the attacker ...

PT-2023-26642

Name of the Vulnerable Software and Affected Versions Wavlink WL WNJ575A3 version R75A3 V1410 220513 Description An issue in the software allows a remote attacker to execute arbitrary code via the username parameter of the set sys adm function in adm.cgi. This enables the attacker to gain...

WAVLINK WL-WNJ575A3: Command Injection Vulnerability

WAVLINK WL-WNJ575A3 is a wireless network signal extender from China RuiYin Technology WAVLINK. The WAVLINK WL-WNJ575A3 suffers from a command injection vulnerability that originates from an application failing to properly filter construct command special characters, commands, etc. The...