QNAP Systems Photo Station Cross-Site Scripting Vulnerability

QNAP Systems Photo Station is an online photo album from QNAP Systems. It is used to organize multimedia content photos and movies on Qnap Nas. A cross-site scripting vulnerability exists in QNAP Systems Photo Station prior to version 6.4.2, which stems from the presence of a cross-site scripting...

CVE-2024-22900

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the setNetworkCardInfo function...

Trend Micro Apex Central Security Vulnerability

Trend Micro Apex Central is a web-based console from Trend Micro, Inc. A security vulnerability exists in Trend Micro Apex Central that stems from an authenticated server-side request forgery SSRF vulnerability. It could allow an attacker to interact directly with internal or local services...

PT-2024-10892 · WordPress · The Simple Post

Name of the Vulnerable Software and Affected Versions: The Simple Post WordPress plugin versions through 1.1 Description: The issue arises from the plugin's failure to sanitize user input when an authenticated user provides a Text value. As a result, these values are not escaped when outputted to...

Remote code execution

An authenticated remote code execution vulnerability in QStar Archive Solutions Release RELEASE3-0 Build 7 Patch 0 allows attackers to arbitrarily execute commands...

CVE-2023-51068

An authenticated reflected cross-site scripting XSS vulnerability in QStar Archive Solutions Release RELEASE3-0 Build 7 allows attackers to execute arbitrary javascript on a victim's browser via a crafted link...

CVE-2023-51066

An authenticated remote code execution vulnerability in QStar Archive Solutions Release RELEASE3-0 Build 7 Patch 0 allows attackers to arbitrarily execute commands...

PT-2023-29424 · Unknown · Online Examination System

Name of the Vulnerable Software and Affected Versions: Online Examination System version 1.0 Description: The issue concerns an Authenticated SQL Injection vulnerability. Specifically, the time parameter of the "update.php" resource does not validate the characters received and they are sent...

CVE-2023-44482

Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-45121

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'desc' parameter of the /update.php?q=addquiz resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-45118

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'fdid' parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-45115 Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi)

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'ch' parameter of the /update.php?q=addqns resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-49270

Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'checkindate' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response...

PT-2023-31466

Name of the Vulnerable Software and Affected Versions Student Information System version 1.0 Description The issue concerns multiple Authenticated SQL Injection vulnerabilities. Specifically, the id parameter of the "marks.php" resource does not validate the characters received, and they are sent...

CVE-2023-50466

An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter...

CVE-2023-47576

CVE-2023-47576 affects Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0. The issue enables authenticated command injection through the devices’ web interface. Root cause details are not provided in the connected documents, so the exact component/flow causing the vulnerability isn’t specified here. The...

CVE-2023-48642

Archer Platform 6.x before 6.13 P2 6.13.0.2 contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through...

Pressference Exporter <= 1.0.3 - Authenticated (Administrator+) SQL Injection

Description The Pressference Exporter plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap plugin = 1.1.11 versions...

CVE-2023-45627

An authenticated Denial-of-Service DoS vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point...