grafana: vulnerable to authorization bypass

A vulnerability was found in Grafana. Due to an error in authorization logic, it is possible for an unprivileged user in a different organization other than the snapshot owner to perform unauthorized actions such as deleting it using a view key...

CVE-2024-4157 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for...

PT-2024-10362 · Drupal · Drupal Commerce View Receipt +1

Name of the Vulnerable Software and Affected Versions: Drupal Commerce View Receipt versions 0.0.0 through 1.0.2 Description: The issue is related to insufficient authorization procedures in the Commerce View Receipt module of the Drupal CMS system. This can allow a remote attacker to bypass...

PT-2024-18284 · WordPress · Nextscripts: Social Networks Auto-Poster

Name of the Vulnerable Software and Affected Versions: NextScripts: Social Networks Auto-Poster plugin for WordPress versions up to, and including, 4.4.3 Description: The issue allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an...

CVE-2024-2036: Missing Authorization

The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the aolmodalbox AJAX action in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscribe...

Drupal Commerce View Receipt module < 1.0.3 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Norman Kämper-Leymann in WordPress Module Commerce View Receipt versions 1.0.3...

PT-2024-35170

Name of the Vulnerable Software and Affected Versions Campcodes Complete Web-Based School Management System version 1.0 Description A critical issue affects some unknown functionality of the file /view/teacher salary details.php, where the manipulation of the index argument leads to SQL injection...

Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

The Commerce View Receipts module enables you to view commerce order receipts in the browser. The module doesn't sufficiently check access permissions, allowing an unauthorised user to view the private information of other customers...

PT-2024-35180

Name of the Vulnerable Software and Affected Versions Campcodes Complete Web-Based School Management System version 1.0 Description A critical issue affects the processing of the file /view/teacher salary history1.php, where the manipulation of the index argument leads to SQL injection. The attac...

PT-2024-35191 · Unknown · Campcodes Complete Web-Based School Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complete Web-Based School Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file /view/teacher salary invoice.php. The manipulation of the teacher id...

Rockwell Automation HMI Software FactoryTalk View SE Datalog Full Access

The vulnerability of the reporting function of the Rockwell Automation FactoryTalk View SE Datalog software is related to errors in processing input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full access to the data by sending a specially crafted SQL...

AVideo cross-site scripting vulnerability in the view/about.php page

The PHP file view/about.php is vulnerable to an XSS issue due to no sanitization of the user agent. At line 53, the website gets the user-agent from the headers through $SERVER'HTTPUSERAGENT' and echo it without any sanitization. In PHP, echo a user generated statement, here the User-Agent Header...

CVE-2024-5113

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /view/studentprofile1.php. The manipulation of the argument stdindex leads to sql injection. The attack may be initiated...

CVE-2024-5110

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view/studentpaymentinvoice.php. The manipulation of the argument index leads to sql injection. The attack may be...

CVE-2024-5109

A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /view/studentpaymenthistory.php. The manipulation of the argument index leads to sql injection. The attack...

CVE-2024-5107

A vulnerability, which was classified as critical, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unknown processing of the file /view/studentpaymentdetails2.php. The manipulation of the argument index leads to sql injection. The attack may be...

Complete Web-Based School Management System SQL Injection Vulnerabilities

Campcodes Complete Web-Based School Management System is a web-based school management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Complete Web-Based School Management System version 1.0, which originates from an unknown function in /view/studentprofile.php that...

Complete Web-Based School Management System SQL Injection Vulnerabilities

Campcodes Complete Web-Based School Management System is a Web-based school management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Complete Web-Based School Management System version 1.0, which originates from an unknown function in /view/student...

PT-2024-34530 · Campcodes · Campcodes Complete Web-Based School Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Complete Web-Based School Management System version 1.0 Description: A critical issue has been discovered, affecting the /view/student profile.php file. The manipulation of the std index argument leads to SQL injection. This issue c...

Rockwell Automation FactoryTalk View SE SQL Injection Vulnerability

Rockwell Automation FactoryTalk View SE is an industrial automation system view interface from Rockwell Automation. Rockwell Automation FactoryTalk View SE suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in a back-end...