EUVD-2020-21810

Malware in sbrugna...

CVE-2020-29437

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

CVE-2020-29437

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

Sql injection

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

CVE-2020-29437

CVE-2020-29437 describes an SQL injection in the Buzz module of OrangeHRM (up to version 4.6) that allows remote authenticated attackers to execute arbitrary SQL commands via the loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint. The underlying issue is unvalidated i...

CVE-2020-29437

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

CVE-2020-29437: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsFormprofileUserId parameter to the buzz/loadMoreProfile endpoint...

PT-2021-11664

Name of the Vulnerable Software and Affected Versions: OrangeHRM versions through 4.6 Description: The issue allows remote authenticated attackers to execute arbitrary SQL commands via the loadMorePostsFormprofileUserId parameter to the "buzz/loadMoreProfile" endpoint. This is due to a SQL...