Sourcecodester Seat-Reservation-System SQL Injection Vulnerability

Seat-Reservation-System is a seat reservation system. A sql injection vulnerability exists in Seat-Reservation-System 1.0. The vulnerability is caused due to the id and file parameters in the index.php file not being input/output filtered for special characters. An attacker can exploit this...

QIWI: Remote Code Execution on contactws.contact-sys.com via SQL injection in TAktifBankObject.GetOrder in parameter DOC_ID

Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the DOCID parameter on the TAktifBankObject operation GetOrder to inject arbitrary SQL statements into...

CVE-2020-29140

A SQL injection vulnerability in interface/reports/immunizationreport.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

Sql injection

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...

Cisco SD-WAN vManage SQL Injection

The vulnerability in the vManage web interface of the Cisco SD-WAN programmatically defined network is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Ming-Soft MCMS SQL Injection (CVE-2020-23262)

An SQL injection vulnerability exists in Ming-Soft MCMS. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2020-21176

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter...

CVE-2020-21176

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter...

Sql injection

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands...

Sql injection

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter...

CVE-2020-20296

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20296

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20296: Improper Neutralization of Special Elements used in an SQL Command

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

PT-2021-10600

Name of the Vulnerable Software and Affected Versions: ThinkJS version 3.2.10 Description: The issue allows remote attackers to execute arbitrary SQL commands via the step parameter in the model.increment and model.decrement functions. This enables attackers to potentially access or modify...

PT-2021-10476

Name of the Vulnerable Software and Affected Versions: CMSWing version 1.3.8 Description: An issue was found in the CMSWing project where the rechargeAction function does not check the balance parameter, allowing malicious parameters to execute arbitrary SQL commands. Recommendations: For CMSWing...

CVE-2020-20295: Improper Neutralization of Special Elements used in an SQL Command

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands...

SQL Injection

spring-cloud-task-core is vulnerable to SQL injection. Lack of validation of the value that is passed via a PageRequest into the JdbcTaskExecutionDao potentially allows for execution of arbitrary SQL statements...

Cisco Data Center Network Manager SQL Injection Vulnerabilities (cisco-sa-dcnm-sql-inj-OAQOObP)

The version of Cisco Data Center Network Manager DCNM installed on the remote host is affected by multiple SQL injection vulnerabilities in certain REST API endpoints. An authenticated, remote attacker can exploit this, by suppling crafted input, in order to execute arbitrary SQL commands on an...

EVOLUCARE ECS Imaging SQL Injection (CVE-2021-3118)

An SQL injection vulnerability exists in EVOLUCARE ECS Imaging. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

PT-2021-1871

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM affected versions not specified Description The issue is related to the implementation of the REST API interface in Cisco Data Center Network Manager DCNM, which lacks protection against SQL query structu...