254 matches found
CVE-2024-37767
The 14Finger web fingerprint recognition platform (version 1.1 ) is vulnerable to an insecure permissions flaw in the /api/admin/user component. This allows an attacker to perform a crafted GET request to access all user information, including usernames and other sensitive data. As no patched ver...
CVE-2024-37767
Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request...
CVE-2024-37768
14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...
CVE-2024-33443
The onethink content management framework (version v.1.1 ) is vulnerable to arbitrary code execution. A remote attacker can exploit the AddonsController.class.php component by sending a crafted script . The root cause is categorized as Improper Control of Generation of Code (CWE-94). To mitigate ...
CVE-2024-29278
funboot v1.1 is vulnerable to Cross Site Scripting XSS via the title field in "create a message ."...
CVE-2024-29278
funboot v1.1 is vulnerable to Cross Site Scripting XSS via the title field in "create a message ."...
CVE-2024-29278
funboot v1.1 is vulnerable to Cross Site Scripting XSS via the title field in "create a message ."...
CVE-2024-29278
funboot v1.1 , a Yii2-based SaaS rapid development platform, is vulnerable to Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input in the title field within the "create a message" endpoint, which allows for potential malicious script injection. As a temporary workar...
CVE-2024-24112
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter...
Sql injection
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter...
CVE-2024-24112
The Exrick XMall e-commerce platform (v1.1 ) is vulnerable to a SQL injection vulnerability (CWE-89) through the orderDir parameter. Unauthenticated attackers can exploit this flaw to extract sensitive database information. The vulnerability has been reported as exploited in the wild and a proof-...
CVE-2024-24112
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter...
CVE-2023-50614
An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci...
Design/Logic Flaw
An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci...
CVE-2023-50614
CVE-2023-50614 affects EBYTE E880-IR01-V1.1 (router). A vulnerability in the /cgi-bin/luci POST handling could allow an attacker to obtain sensitive information, per multiple sources (NVD/Red Hat/CNNVD variants). The CVSSv3.1 vector indicates Network access, Low auth, No user interaction, with Co...
CVE-2023-50614: Cleartext Transmission of Sensitive Information
An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci...
CVE-2023-50614
An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci...
CVE-2023-51978: Improper Neutralization of Special Elements used in an SQL Command
In PHPGurukul Art Gallery Management System v1.1, "Update Artist Image" functionality of "imageid" parameter is vulnerable to SQL Injection...
