Code injection

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the...

CVE-2024-23824 mailcow ipixel flood attack leads to Denial of Service in admin page

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the...

EmpireCMS SQL Injection Vulnerability (CNVD-2024-05638)

EmpireCMS Empire Content Management System is an open source content management system CMS. EmpireCMS v7.5 suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. A remote attacker can exploit this vulnerability to...

nesd.ca Cross Site Scripting vulnerability OBB-3826601

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-6719

An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable application, and can be exploited by a third party by sending a specially crafted JavaScript payload to a user, and thus gain full control of their session...

PT-2023-21794 · Unknown · Sps Application

Name of the Vulnerable Software and Affected Versions: SPS Application affected versions not specified Description: The issue is related to memory corruption in the SPS Application when exporting a public key in the sorter TA. This can potentially lead to code execution. Recommendations: At the...

Cross Site Scripting (XSS)

org.opencrx: opencrx-core-models is vulnerable to HTML Injection. The vulnerability is due to a lack of proper input sanitization in the Accounts Group Name Field. This allows an attacker to inject malicious HTML into the application...

Fortinet FortiWLM SQL Injection Vulnerability (CNVD-2024-13757)

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. Fortinet FortiWLM suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker could use this vulnerability to execute unauthorized code or commands via...

PT-2023-20550 · Tibco Software · Tibco Ebx +1

Name of the Vulnerable Software and Affected Versions: TIBCO EBX versions 5.9.22 and below TIBCO EBX versions 6.0.13 and below TIBCO Product and Service Catalog powered by TIBCO EBX versions 5.0.0 and below Description: The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO...

CVE-2023-6097 SQL Injection on ICSSolution ICS Business Manager

A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing t...

Saad Irfan RemoteClinic Security Vulnerability

Saad Irfan RemoteClinic is a Saad Irfan open source application. It provides the ability to remotely manage your clinic via the Web. A security vulnerability exists in RemoteClinic version 2.0, which stems from a SQL injection vulnerability in the parameter ID of the file /medices/stocks.php...

CVE-2023-5516

Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical detai...

PT-2023-18103 · Unknown · Permission Manager

Name of the Vulnerable Software and Affected Versions: Permission Manager affected versions not specified Description: The issue allows an attacker to determine whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information...

CVE-2023-45228

The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters...

PT-2023-21033 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to an unauthenticated SQL injection in the GetRoomChanges method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions...

Weintek cMT Buffer Error Vulnerability

Weintek cMT is a human machine interface application from Weintek. A security vulnerability exists in the Weintek cMT3000 HMI Web CGI, which stems from the fact that cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypa...

CVE-2023-5391

A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to the application...

Citadel WebCit vulnerable to cross-site scripting on Instant Messaging facility

Overview Citadel WebCit provided by Citadel contains a cross-site scripting vulnerability CWE-79. Tomoro Taniguchi of FiveDrive, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When a malicious user sen...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Column Management component. An attacker can inject malicious scripts that are executed when users interact with the web application by exploiting the lack of proper input sanitisation. Details Cross-sit...

PT-2023-27727 · Idm Sistemas Qsige +1 · Qsige

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The web application does not correctly filter input parameters, allowing for SQL injections, Denial of Service DoS, or information disclosure. It is...