RuoYi SQL注入漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A SQL injection vulnerability exists in RuoYi 4.7.7 and earlier versions. The vulnerability stems from improperly filtered sql statements, resulting in SQL injection and DoS attacks...

CVE-2023-28700: Unrestricted Upload of File with Dangerous Type

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

PT-2023-3469 · Unknown · Omicard Edm +1

Name of the Vulnerable Software and Affected Versions: OMICARD EDM ITPison affected versions not specified OMICARD EDM affected versions not specified Description: The issue is related to the file uploading function in the OMICARD EDM backend system, which does not restrict the upload of files wi...

distribution catalog API endpoint can lead to OOM via malicious user input

Impact Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/catalog API endpoint request. Patches Upgrade to at least 2.8.2-beta.1 if you are running v2.8.x release. If you use the code...

X-Man SQL注入漏洞

X-Man is a backend system based on ThinkPHP framework developed by S1xGod individual developers. A security vulnerability exists in X-Man version 1.0. An attacker exploited the vulnerability to perform SQL injection attacks...

CVE-2021-40503

An information disclosure vulnerability exists in SAP GUI for Windows - versions 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able ...

CVE-2021-40503: Insufficiently Protected Credentials

An information disclosure vulnerability exists in SAP GUI for Windows - versions 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able ...

XSS Vulnerability in WeChat Public Number Backend System

WeChat public number belongs to Tencent, is the developer or business in the WeChat public platform application account, the account and QQ account interoperability, the platform to achieve and specific groups of text, pictures, voice, video, a full range of communication, interaction , the...

Weak Password Vulnerability in Guangzhou Kingston's Dynamic Loop Monitoring Backend System

Guangzhou Kingston Electronic Technology Co., Ltd. is a high-tech company integrating R&D, production and sales, and is the leading developer and manufacturer of networked computer room power environment monitoring equipment in China. A weak password vulnerability exists in the back-end system of...

SQL Injection Vulnerability in Dynamic Ring Monitoring Backend System of Guangzhou Kingston Electronic Technology Company Limited (CNVD-2021-54063)

Guangzhou Kingston Electronic Technology Co., Ltd. is a high-tech company integrating R&D, production and sales, and is the leading developer and manufacturer of networked computer room power environment monitoring equipment in China. Guangzhou Kingston Electronic Technology Co., Ltd. dynamic rin...

SQL Injection Vulnerability in Dynamic Ring Monitoring Backend System of Guangzhou Kingston Electronic Technology Co.

Guangzhou Kingston Electronic Technology Co., Ltd. is a high-tech company integrating R&D, production and sales. Guangzhou Kingston Electronic Technology Co., Ltd. dynamic ring monitoring backend system SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive informati...

Nord Security: Getting SmartDNS for free from - join.nordvpn.com

The reporter identified an issue within our backend system which performs validation of the active services. There was a misconfiguration related to caching and time period calculation. This lead to SmartDNS service being active for a longer period of time than it should have been, compared with...

CSZ CMS 1.2.7 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: CSZ CMS 1.2.7 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/ Version: v1.2.7 Description: Unauthorized user...

CSZ CMS 1.2.7 - (title) HTML Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: CSZ CMS 1.2.7 - 'title' HTML Injection Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/ Version: v1.2.7 Description: Authenticated user can...

CSZ CMS 1.2.7 HTML Injection

Exploit Title: CSZ CMS 1.2.7 - 'title' HTML Injection Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/ Version: v1.2.7 Description: Authenticated user can inject hyperlink to Backend System Dashboard and Member...

CSZ CMS 1.2.7 - 'title' HTML Injection

Exploit Title: CSZ CMS 1.2.7 - 'title' HTML Injection Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/ Version: v1.2.7 Description: Authenticated user can inject hyperlink to Backend System Dashboard and Member...

Visma Bug Bounty Program: Administration page visible without authentication

A backend system administration interface could be accessed without authorization, but it did not display any data unless the user was correctly logged in...

Razer: Leftover back-end system on www.zest.co.th allows an unauthorized attacker to generate Razer Gold Pin for free

The tester discovered a residual backend system was left exposed. The system was removed from public access. Razer thanks the tester for his diligence...

SQL Injection Vulnerability in zhicms Background ad***.php Page

ZhiCms is an enterprise building system based on PHP and mysql technology. A SQL injection vulnerability exists in the ad.php page in the background of zhicms, which can be exploited by attackers to obtain sensitive information such as database...

Logic flaw vulnerability in Ruoyi's backend management system

Ruoyi backend management system is based on SpringBoot2.0 rights management system . A logic flaw vulnerability exists in the Ruoyi Backend Management System. An attacker can view the source code to obtain a username and password to log in to the backend...