CVE-2024-25247

SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude and longitude parameters...

CVE-2024-25248

SQL Injection vulnerability in the orderGoodsDelivery function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the orderid parameter...

CVE-2024-25248

Niushop B2B2C V5 is affected by a SQL Injection in the orderGoodsDelivery() function, exploitable via the order_id parameter. The CVE-2024-25248 entry shows a critical impact (C/H/I/A = High) with network access and no privileges required, per CVSS 3.1 metrics. Connected documents corroborate the...

CVE-2024-25248

SQL Injection vulnerability in the orderGoodsDelivery function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the orderid parameter...

CVE-2024-25247

The Niushop B2B2C V5 e-commerce system is vulnerable to a SQL Injection flaw in the /app/api/controller/Store.php component. The root cause is the improper neutralization of special elements, which allows attackers to execute arbitrary SQL commands by manipulating the latitude and longitude param...

CVE-2024-25248: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in the orderGoodsDelivery function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the orderid parameter...

CVE-2024-25247: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude and longitude parameters...

CVE-2024-0942

A vulnerability was found in Totolink N200RE V5 9.3.5u.6255B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. It is possible to launch the attack remotely. The complexity of an attack is...

CVE-2024-0942 Totolink N200RE V5 cstecgi.cgi session expiration

A vulnerability was found in Totolink N200RE V5 9.3.5u.6255B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. It is possible to launch the attack remotely. The complexity of an attack is...

CVE-2024-0942 Totolink N200RE V5 cstecgi.cgi session expiration

A vulnerability was found in Totolink N200RE V5 9.3.5u.6255B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. It is possible to launch the attack remotely. The complexity of an attack is...

CVE-2024-0933

A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and ma...

Out-of-bounds

A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and ma...

CVE-2024-0933

Niushop B2B2C V5 contains a vulnerability in the file app/model/Upload.php that allows unrestricted upload. Exploitation is possible remotely, and the exploit has been disclosed publicly (VDB-252140). Several sources confirm the issue and note vendor contact without response; no remediation detai...

CVE-2024-0933 Niushop B2B2C Upload.php unrestricted upload

A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and ma...

CVE-2024-0942: Insufficient Session Expiration

A vulnerability was found in Totolink N200RE V5 9.3.5u.6255B20211224. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. It is possible to launch the attack remotely. The complexity of an attack is...

CVE-2024-0933: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and ma...

MAL-2024-138 Malicious code in cagov-template-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 041aa485b2de4fd90575bf3656a8dee0ce0c0a4319b0919b62d35f6b98b090c6 The OpenSSF Package Analysis project identified 'cagov-template-v5' @ 19.2.0 npm as malicious. It is considered malicious because: - The package...

PT-2024-11729 · Totolink · Totolink N200Re V5

Name of the Vulnerable Software and Affected Versions: Totolink N200RE V5 version V9.3.5u.6255 B20211224 Description: The issue allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page due to Incorrect Access...

OESA-2024-1022 mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

OESA-2024-1028 mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...