2771 matches found
Sql injection
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection...
WordPress plugin Logo Slider SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. The WordPress Logo Slider plugin 1.4.8 and earlier versions are vulnerable to SQL injection, which stems...
PT-2022-14409
Name of the Vulnerable Software and Affected Versions SourceCodester Prison Management System version 1.0 Description A critical vulnerability has been found in the SourceCodester Prison Management System. The issue is related to the manipulation of the id argument in the /admin/?page=inmates/vie...
LibreHealth EHR 跨站脚本漏洞
LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare settings. version 2.0.0 of LibreHealth EHR is vulnerable to a cross-site scripting vulnerability that originates in the...
PT-2022-14428
Name of the Vulnerable Software and Affected Versions SourceCodester Prison Management System version 1.0 Description A problematic issue has been discovered, affecting some unknown functionality of the file "/admin/?page=system info" of the System Name Handler component. The manipulation of the...
CVE-2022-2020: Improper Neutralization of Input During Web Page Generation
A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/?page=systeminfo of the component System Name Handler. The manipulation with the input leads to cross site...
CVE-2022-1695 WP Simple Adsense Insertion < 2.1 - Inject ads and javascript via CSRF
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form...
CVE-2022-1690 Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection...
CVE-2022-1695: Cross-Site Request Forgery (CSRF)
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form...
PT-2022-14052
Name of the Vulnerable Software and Affected Versions WP Simple Adsense Insertion WordPress plugin versions prior to 2.1 Description The issue allows an attacker to trick a logged-in user into manipulating ads and injecting arbitrary javascript via submitting a form, due to the lack of CSRF check...
CVE-2022-32027
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/index.php?page=managecar&id=...
CVE-2022-31994
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=sales/viewdetails&id...
CVE-2022-32007
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=...
CVE-2022-31992
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=courtrentals/viewcourtrental&id=...
CVE-2022-32000
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=servicetransactions/manageservicetransaction&id=...
CVE-2022-31981
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/viewteam&id=...
CVE-2022-31983
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/managerequest&id=...
CVE-2022-31981
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/viewteam&id=...