Sql injection

A SQL injection vulnerability in interface/reports/immunizationreport.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

CVE-2020-29143

A SQL injection vulnerability in interface/reports/nonreported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

CVE-2020-29140

A SQL injection vulnerability in interface/reports/immunizationreport.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

CVE-2020-29142

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

Sql injection

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

OS Command Injection

samba-client is vulnerable to OS command injection. The use of process.exec allows an attacker to inject and execute arbitrary OS commands on the host OS...

Endian Firewall Community Operating System Command Injection Vulnerability

Endian Firewall Community is a firewall for the Endian community in the UK. It provides network protection. An operating system command injection vulnerability exists in Endian Firewall Community 3.3.2, which allows remote authenticated users to execute arbitrary operating system commands...

TestLink 1.9.20 - Unrestricted File Upload (Authenticated)

Exploit Title: TestLink 1.9.20 - Unrestricted File Upload Authenticated Date: 14th February 2021 Exploit Author: snovvcrash Original Research by: Ackcent AppSec Team Original Research: https://ackcent.com/testlink-1-9-20-unrestricted-file-upload-and-sql-injection/ Vendor Homepage:...

Mutare Voice SQL Injection Vulnerability

A SQL injection vulnerability exists in Mutare Voice that stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to execute illegal SQL commands...

CVE-2021-20648

ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20639

LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20639

LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20639

The CVE-2021-20639 entry concerns LOGITEC LAN-W300N/PGRB with an OS command injection flaw. Connected sources confirm the issue is OS command injection (CWE-78) in LAN-W300N/PGRB that can be exploited by an attacker with administrative privileges to run arbitrary OS commands, from vectors not spe...

vSphere Replication Command Injection Vulnerability

A command injection vulnerability exists in vSphere Replication that originates when a network system or product does not properly filter specific elements of externally entered data during the construction of executable commands. An attacker could exploit this vulnerability to execute an illegal...

CVE-2020-26193

Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain an improper input validation vulnerability. A user with the ISIPRIVCLUSTER privilege may exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable...

The vulnerability of the REST API implementation of the network management system’s data center management module allows a attacker to execute arbitrary SQL commands.

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

Security Updates for Microsoft Office Online Server and Microsoft Office Web Apps (February 2021)

The Microsoft Office Online Server or Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute...

The vulnerability of the user role management service in the Cisco DNA Center allows a hacker to execute arbitrary commands.

The vulnerability of the user role management service at the Cisco DNA Center is related to privilege assignment errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

D-link DSR-250 UPnP service command injection vulnerability

The D-link DSR-250 is a Unified Services Router. An input validation vulnerability exists in the D-link DSR-250 UPnP service, which allows remote attackers to exploit the vulnerability to submit a special request that can be used in the service context to execute arbitrary commands...

PrestaShop SQL Injection (CVE-2021-3110)

An SQL injection vulnerability exists in PrestaShop. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...