5522 matches found
CVE-2021-32983
Delta Electronics DIAEnergie vulnerability CVE-2021-32983 is a Blind SQL Injection in the /DataHandler/Handler_CFG.ashx endpoint (versions prior to 1.9). The flaw arises from improper validation of the keyword parameter before building an SQL query, allowing remote, unauthenticated attackers to e...
CVE-2021-38393
Delta Electronics DIAEnergie (all versions before 1.9) contains a Blind SQL injection in /DataHandler/HandlerAlarmGroup.ashx via the agid parameter, enabling remote, unauthenticated code execution in NT SERVICES\MSSQLSERVER. This is tied to CVE-2021-38393. Impact is high (CVE has CVSS v3.1 base s...
CVE-2021-38391
A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...
CVE-2021-37749
MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...
CVE-2021-37749
MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...
Sql injection
MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...
CVE-2021-37749
The CVE-2021-37749 entry concerns Hexagon GeoMedia WebMap 2020 prior to Update 2 (16.6.2.66). A vulnerability in MapService.svc allows blind SQL injection via the Id (within sourceItems) parameter to the GetMap method. CVSSv3.1 base score 9.8 (CRITICAL) with network attack vector, no user interac...
PT-2021-22107
Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists in the "/DataHandler/HandlerAlarmGroup.ashx" endpoint. The application does not properly validate the user-controlled value supplied through t...
CVE-2021-38393: Improper Neutralization of Special Elements used in an SQL Command
A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query....
PT-2021-22104
Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists due to improper validation of the user-controlled value supplied through the egyid parameter in the "/DataHandler/HandlerEnergyType.ashx"...
PT-2021-20006
Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists due to improper validation of the user-controlled value supplied through the keyword parameter in the "/DataHandler/Handler CFG.ashx" endpoint...
PT-2021-22105
Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists due to improper validation of the type parameter in the "/DataHandler/AM/AM Handler.ashx" endpoint. This allows a remote, unauthenticated...
CVE-2021-37749: Improper Neutralization of Special Elements used in an SQL Command
MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...
CVE-2021-38391: Improper Neutralization of Special Elements used in an SQL Command
A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...
CVE-2021-38390: Improper Neutralization of Special Elements used in an SQL Command
A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...
PT-2021-21860
Name of the Vulnerable Software and Affected Versions: Hexagon GeoMedia WebMap 2020 versions prior to 16.6.2.66 Description: The issue allows blind SQL Injection via the Id parameter within sourceItems to the GetMap method. This can be exploited through the MapService.svc endpoint. Recommendation...
CVE-2021-31867: Improper Neutralization of Special Elements used in an SQL Command
Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application. This issue was fixed in version 3.0.2 of the product...
Oracle Fatwire 6.3 Cross Site Scripting / SQL Injection
Exploit Title: Oracle Fatwire 6.3 - Multiple Vulnerabilities Date: 29/07/2021 Exploit Author: J. Francisco Bolivar @Jfrancbit Vendor Homepage: https://www.oracle.com/index.html Version: 6.3 Tested on: CentOS 1. Xss Adt parameter is vulnerable to Xss:...
Oracle Fatwire 6.3 - Multiple Vulnerabilities
Exploit Title: Oracle Fatwire 6.3 - Multiple Vulnerabilities Date: 29/07/2021 Exploit Author: J. Francisco Bolivar @Jfrancbit Vendor Homepage: https://www.oracle.com/index.html Version: 6.3 Tested on: CentOS 1. Xss Adt parameter is vulnerable to Xss:...
