Sql injection

MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...

CVE-2021-37749

The CVE-2021-37749 entry concerns Hexagon GeoMedia WebMap 2020 prior to Update 2 (16.6.2.66). A vulnerability in MapService.svc allows blind SQL injection via the Id (within sourceItems) parameter to the GetMap method. CVSSv3.1 base score 9.8 (CRITICAL) with network attack vector, no user interac...

CVE-2021-38393: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query....

PT-2021-21860

Name of the Vulnerable Software and Affected Versions: Hexagon GeoMedia WebMap 2020 versions prior to 16.6.2.66 Description: The issue allows blind SQL Injection via the Id parameter within sourceItems to the GetMap method. This can be exploited through the MapService.svc endpoint. Recommendation...

PT-2021-22105

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists due to improper validation of the type parameter in the "/DataHandler/AM/AM Handler.ashx" endpoint. This allows a remote, unauthenticated...

PT-2021-22104

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists due to improper validation of the user-controlled value supplied through the egyid parameter in the "/DataHandler/HandlerEnergyType.ashx"...

PT-2021-20006

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists due to improper validation of the user-controlled value supplied through the keyword parameter in the "/DataHandler/Handler CFG.ashx" endpoint...

PT-2021-22107

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description A Blind SQL injection issue exists in the "/DataHandler/HandlerAlarmGroup.ashx" endpoint. The application does not properly validate the user-controlled value supplied through t...

CVE-2021-37749: Improper Neutralization of Special Elements used in an SQL Command

MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...

CVE-2021-38390: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...

CVE-2021-38391: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...

CVE-2021-31867: Improper Neutralization of Special Elements used in an SQL Command

Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application. This issue was fixed in version 3.0.2 of the product...

Oracle Fatwire 6.3 Cross Site Scripting / SQL Injection

Exploit Title: Oracle Fatwire 6.3 - Multiple Vulnerabilities Date: 29/07/2021 Exploit Author: J. Francisco Bolivar @Jfrancbit Vendor Homepage: https://www.oracle.com/index.html Version: 6.3 Tested on: CentOS 1. Xss Adt parameter is vulnerable to Xss:...

Oracle Fatwire 6.3 - Multiple Vulnerabilities

Exploit Title: Oracle Fatwire 6.3 - Multiple Vulnerabilities Date: 29/07/2021 Exploit Author: J. Francisco Bolivar @Jfrancbit Vendor Homepage: https://www.oracle.com/index.html Version: 6.3 Tested on: CentOS 1. Xss Adt parameter is vulnerable to Xss:...

Exploit for SQL Injection in Virtuasoftware Cobranca

My CVEs Collection of PoC to my C...

TripSpark VEO Transportation - Blind SQL Injection Vulnerability

Exploit Title: TripSpark VEO Transportation - 'editOEN' Blind SQL Injection Google Dork: inhtml:"Student Busing Information" Exploit Author: Sedric Louissaint @LKn0w Vendor Homepage: https://www.tripspark.com Software Document Link: https://www.tripspark.com/resourcefiles/veo-transportation.pdf...

TripSpark VEO Transportation - Blind SQL Injection

Exploit Title: TripSpark VEO Transportation - 'editOEN' Blind SQL Injection Google Dork: inhtml:"Student Busing Information" Date: 07/27/2021 Exploit Author: Sedric Louissaint @LKn0w Vendor Homepage: https://www.tripspark.com Software Document Link:...

CVE-2021-30486

SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp GET computerID, AssetManagementChart.jsp POST group1, AssetManagementList.jsp GET computerID or group1, or AssetManagementSummary.jsp GET group1...

CVE-2021-30486

SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (POST group1), AssetManagementList.jsp (GET computerID or group1), or AssetManagementSummary.jsp (GET group1). The CVE-2021-30486 entries confirm this remote, ...

CVE-2021-30486: Improper Neutralization of Special Elements used in an SQL Command

SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp GET computerID, AssetManagementChart.jsp POST group1, AssetManagementList.jsp GET computerID or group1, or AssetManagementSummary.jsp GET group1...