PT-2023-16929 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.0.2 Description: The issue is related to improper restriction of rendered UI layers or frames. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue...

CVE-2023-1362 Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys

Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2...

CVE-2023-1361

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...

CVE-2023-1362

Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2...

CVE-2023-1361: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...

CVE-2023-1362: Improper Restriction of Rendered UI Layers or Frames

Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2...

CVE-2023-1361

CVE-2023-1361 : SQL Injection in the open-source project unilogies/bumsys prior to v2.0.2. The vulnerability stems from core/ajax/ajax_data.php where customer_id is sanitized but interpolated into an unquoted numeric context, allowing injected SQL (example PoC in Huntr shows a time-based sleep). ...

WS-2023-0123

A SQL Injection vulnerability was found in unilogies/bumsys before 2.2.0 in '/core/ajax/ajaxselect2.php...

PT-2023-7320 · Bumsys · Bumsys

Name of the Vulnerable Software and Affected Versions: bumsys versions prior to 2.1.1 Description: The issue is related to a PHP Remote File Inclusion vulnerability. This could allow a remote attacker to execute arbitrary code by sending specially crafted requests. Recommendations: For versions...

WS-2023-0059

In unilogies/bumsys, there exists an SQL injection affecting the customerid parameter located in the file core/ajax/ajaxdata.php...

WS-2023-0065

UI REDRESSING exists in unilogies/bumsys. The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with...

CVE-2023-0995

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to v2.0.1...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to v2.0.1...

bumsys 跨站脚本漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. A cross-site scripting vulnerability exists in versions of bumsys prior to v2.0.1. Attackers use this vulnerability to execute cross-site scripting attacks...

CVE-2023-0995 Cross-site Scripting (XSS) - Stored in unilogies/bumsys

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to v2.0.1...

CVE-2023-0995 Cross-site Scripting (XSS) - Stored in unilogies/bumsys

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to v2.0.1...

PT-2023-16674 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.0.1 Description: The issue is related to Cross-site Scripting XSS - Stored. This type of attack occurs when an application stores user input and later displays it to other users without proper validation o...

CVE-2023-0995

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to v2.0.1...

CVE-2023-0995: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to v2.0.1...

CVE-2023-0995

CVE-2023-0995 is a stored XSS in unilogies/bumsys prior to v2.0.1. Affected component(s): the web app handling user input stored and later displayed. Exploitability is evidenced by a PoC showing a payload in a POST to customer-support flow, triggering test. Remediation: upgrade to version 2.0.1 o...