CVE-2024-2916

A vulnerability was found in Campcodes House Rental Management System 1.0. It has been classified as critical. Affected is an unknown function of the file ajax.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

PT-2024-6563 · Campcodes · Campcodes House Rental Management System

Name of the Vulnerable Software and Affected Versions: Campcodes House Rental Management System version 1.0 Description: The issue is related to a lack of protection against SQL query structure exploitation in the Campcodes House Rental Management System. This allows a remote attacker to execute...

House Rental Management System SQL注入漏洞

House Rental Management System is a house rental management system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Campcodes House Rental Management System version 1.0, which originates from a SQL injection vulnerability in the parameter username in the file ajax.php...

Complete Online Beauty Parlor Management System /index.php File SQL Injection Vulnerability

Complete Online Beauty Parlor Management System is an online beauty parlor management system. Complete Online Beauty Parlor Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the username parameter of the...

PT-2024-19425 · Hitachi Energy · Asset Suite Eam +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a REST service authentication anomaly where a "valid username/no password" credential combination allows for successful service...

The vulnerability in the `apply.cgi` interface of TRENDnet TEW-827DRU’s CGI microprogramming system allows a hacker to escalate their privileges and execute arbitrary commands.

The vulnerability in the apply.cgi interface of TRENDnet TEW-827DRU microprogramming software’s CGI interface is related to the failure to take measures to neutralize special elements used in the OS command when processing the usapps.d.username parameter. Exploiting this vulnerability allows a...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Connectwise Screenconnect

ConnectWise ScreenConnect: Authentication Bypass Introduct...

CVE-2024-2766

A vulnerability has been found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely...

Campcodes Complete Online Beauty Parlor Management System SQL注入漏洞

Campcodes Complete Online Beauty Parlor Management System is an online beauty parlor management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Complete Online Beauty Parlor Management System version 1.0, which originates from an SQL injection vulnerability in the...

PT-2024-21982 · Unknown · Campcodes Complete Online Beauty Parlor Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complete Online Beauty Parlor Management System version 1.0 Description: A critical issue has been identified, affecting the /admin/index.php file. The manipulation of the username argument leads to SQL injection. This issue can be...

CVE-2024-2648

A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is...

CVE-2024-28092

UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Ti...

PT-2024-21397 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A problematic issue was found in the affected software, where an unknown function of the file /nac/naccheck.php is impacted. The manipulation of the username argument lead...

Netentsec NS-ASG Application Security Gateway Security Vulnerability

Netentsec NS-ASG Application Security Gateway is an application security gateway from China Netentsec. A security vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which stems from the parameter username in the file /nac/naccheck.php, which can lead to incorrect...

CVE-2024-2586

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/index.php, in the 'username' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

Username Enumeration

Vantage6 is vulnerable to Username Enumeration. This vulnerability is due to inadequate access controls of sensitive information due to the exposure of API routes /recover/lost and /2fa/lost, which allows unauthorized individuals to trigger password or Multi-Factor Authentication MFA token recove...

AMSS++ SQL Injection Vulnerability

AMSS++ is a tool for the office administration support system of Amssplus. An SQL injection vulnerability exists in AMSS++ version 4.31, which originates from an SQL injection vulnerability in the username parameter of the /amssplus/index.php page...

vantage6 vulnerable to a username timing attack on recover password/MFA token

Impact Much like https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost, which send emails to users if they have lost their password or MFA token. Usernames can be...

BradWenqiang HR SQL Injection Vulnerability

HR is a human resources management system by Brad Wenqiang Personal Developer. A SQL injection vulnerability exists in BradWenqiang HR version 2.0, which stems from the fact that incorrect manipulation of the parameter userName can lead to sql injection...

Progress OpenEdge 11.7.x < 11.7.19 / 12.2.x < 12.2.13 / 12.8.x < 12.8.1 (000253075)

The version of Progress OpenEdge installed on the remote host is prior to 11.7.19, 12.2.13, or 12.8.1. It is, therefore, affected by a vulnerability as referenced in the 000253075 advisory. - In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms...