Oracle Fusion Middleware 输入验证错误漏洞

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle USA. The platform provides middleware, software collections, and other capabilities. An input validation error vulnerability exists in Oracle Fusion...

CVE-2022-1666 Secheron SEPCOS Control and Protection Relay

The default password for the web application’s root user the vendor’s private account was weak and the MD5 hash was used to crack the password using a widely available open-source tool...

Patient Records Management System SQL注入漏洞

Sourcecodester Hospital Patient Records Management System is a Web-based application that provides hospitals with an automated platform to store and manage their patient records. Management System is vulnerable to SQL injection, which originates from /hprms/admin/?page=user/manageuser&id= page...

stored xss

Description Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Proof of Concept 1Go to this website: https://titra.io/ 2Click on add Track button 3In the Task field enter...

The Next Generation of Genealogy Sitebuilding SQL注入漏洞

The Next Generation of Genealogy Sitebuilding is a genealogy software in a web server.The Next Generation of Genealogy Sitebuilding version 11.1.0 and earlier versions are vulnerable to SQL injection, which can be exploited by attackers to parameter primaryID to cause SQL injection...

CVE-2022-31976

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleterequest...

QNAP QuTS hero XSS Vulnerability (QSA-21-63)

QNAP QuTS hero is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross-site Scripting (XSS)

Overview org.jenkins-ci:winstone is a command line wrapper around Jetty. Affected versions of this package are vulnerable to Cross-site Scripting XSS via error messages. An attacker can inject arbitrary web script or HTML by crafting malicious input that triggers these error messages. Details...

Online Sports Complex Booking System SQL注入漏洞

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. Online Sports Complex Booking System version 1.0 is vulnerable to a SQL injection vulnerability that originates in scbs/classes/ Master.php?f=deletefacility, the id parameter of the po...

CVE-2022-28606

An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server...

Kyocera d-COLOR MF3555 跨站脚本漏洞

Kyocera d-COLOR MF3555 is a color multifunction printer from Kyocera Japan.A cross-site scripting vulnerability exists in the Kyocera d-COLOR MF3555 2XDS000.002.271 device, which stems from a web application not properly checking parameters before saving them to the server, and can be exploited b...

CVE-2022-28036

AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminajaxnavigation.php...

CVE-2022-1178

Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4...

CVE-2022-0988 Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information

Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product...

CVE-2022-25492

HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php...

CVE-2021-45886

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

Cross site request forgery (csrf)

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

Orchard Core 跨站脚本漏洞

Net Core, an open source modular and multi-tenant application framework built using Asp.Net Core, and a content management system Cms built on top of the framework.A cross-site scripting vulnerability exists in Orchard Core, which stems from the lack of proper validation of client-side data in th...

CVE-2022-24915 ICSA-22-062-01 IPCOMM ipDIO

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. Th...

CVE-2021-44321

Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery CSRF, where an attacker can update/delete items in the inventory. The attacker must be logged into the application create a malicious file for updating the inventory details and items...