2771 matches found
PT-2022-19815
Name of the Vulnerable Software and Affected Versions Simple Client Management System version 1.0 Description The issue is related to SQL Injection. It can be exploited via the id parameter in the /cms/admin?page=client/manage client&id= API endpoint. Recommendations For Simple Client Management...
PT-2022-19946
Name of the Vulnerable Software and Affected Versions Simple Client Management System version 1.0 Description The issue allows for SQL Injection via the "/cms/admin/?page=client/view client&id=" API endpoint, specifically through the id variable. This could potentially lead to unauthorized access...
CVE-2022-29984: Improper Neutralization of Special Elements used in an SQL Command
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=client/viewclient&id=...
PT-2022-19809
Name of the Vulnerable Software and Affected Versions Money Transfer Management System version 1.0 Description The issue concerns SQL Injection via the "/mtms/admin/?page=transaction/send&id=" endpoint, where the id variable is vulnerable. This allows for potential manipulation of database querie...
Money Transfer Management System SQL注入漏洞
Money Transfer Management System is a money transfer management system. Money Transfer Management System 1.0 suffers from a SQL injection vulnerability that originates from a SQL injection point in the /mtms/admin/?page=user/manageuser&id= path in the Insurance Management System system, which can...
PT-2022-19942
Name of the Vulnerable Software and Affected Versions Simple Client Management System version 1.0 Description The issue concerns SQL Injection, which can be exploited via the /cms/admin/?page=user/manage user&id= endpoint. This allows for potential manipulation of database queries. Recommendation...
PT-2022-19810
Name of the Vulnerable Software and Affected Versions Money Transfer Management System version 1.0 Description The issue concerns a SQL Injection vulnerability via the /mtms/admin/?page=user/manage user&id= endpoint. This allows for potential exploitation by injecting malicious SQL code. The id...
PT-2022-19945
Name of the Vulnerable Software and Affected Versions Simple Client Management System version 1.0 Description The issue concerns SQL Injection via the /cms/admin/?page=invoice/view invoice&id= endpoint. This allows for potential manipulation of database queries. Recommendations For Simple Client...
Simple Client Management System SQL注入漏洞
Simple Client Management System is a simple client management system from Carlo Montero's personal developer. version 1.0 of Simple Client Management System is vulnerable to a SQL injection vulnerability that originates in /cms/admin/?page= client/viewclient&id= lacks validation of external input...
PT-2022-19814
Name of the Vulnerable Software and Affected Versions Simple Client Management System version 1.0 Description The issue is related to SQL Injection. It can be exploited via the "/cms/admin/?page=invoice/manage invoice&id=" endpoint, where the id variable is vulnerable. Recommendations For Simple...
PT-2022-19955
Name of the Vulnerable Software and Affected Versions Online Sports Complex Booking System version 1.0 Description The issue is related to SQL Injection via the "/scbs/admin/?page=facilities/manage facility&id=" endpoint. This allows for potential exploitation. Recommendations For Online Sports...
CVE-2022-29980: Improper Neutralization of Special Elements used in an SQL Command
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=user/manageuser&id=...
Simple Client Management System SQL注入漏洞
Simple Client Management System is a simple client management system from Carlo Montero's personal developer. version 1.0 of Simple Client Management System is vulnerable to a SQL injection vulnerability that originates in /cms/admin/?page=user/ The vulnerability is caused by the lack of validati...
PT-2022-19956
Name of the Vulnerable Software and Affected Versions Online Sports Complex Booking System version 1.0 Description The issue concerns a SQL Injection vulnerability via the "/scbs/admin/?page=clients/manage client&id=" endpoint. This allows for potential exploitation by injecting malicious SQL cod...
Cross site scripting
The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...
CVE-2022-0625 Admin Menu Editor <= 1.0.4 - Reflected Cross-Site Scripting
The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...
Logo Slider <= 1.4.8 - Admin+ SQLi
The plugin does not sanitise and escape the lspsliderid parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection PoC https://example.com/wp-admin/admin.php?page=manageimagessliderid=1+AND+SELECT+7741+FROM+SELECTSLEEP5hlAf...
Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions
The plugin does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection PoC...
JivoChat < 1.3.5.4 - Stored Cross-Site Scripting via CSRF
The plugin does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript. PoC XSS will be triggered...
