48 matches found
Cloudlog - SQL Injection
Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php requestform, letting attackers execute arbitrary SQL commands via stationid or callsign, exploit requires sending crafted request. id: CVE-2024-48259 info: name: Cloudlog - SQL Injection author: s4e-io severity: high...
Cross-site Scripting in FreeTAKServer-UI
FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting XSS vulnerability via the Callsign parameter...
PYSEC-2026-639 Cross-site Scripting in FreeTAKServer-UI
FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting XSS vulnerability via the Callsign parameter...
SQL Injection Vulnerabilities in Tickets
Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a SQL injection vulnerability. This vulnerability stemmed from the fact that the values of latitude, longitude, callsign, mph, altitude, and timestamp,...
EUVD-2024-41625
Malicious code in bioql PyPI...
EUVD-2022-1427
Malicious code in bioql PyPI...
EUVD-2024-42276
Malicious code in bioql PyPI...
Malware in callsign-async-runner
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in callsign-async-runner (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 993c282c40085606e14525d46841a996c7a8dcd50109db7828093a3d60254942 Any computer that has this package installed or running should be considered...
MAL-2025-5374 Malicious code in callsign-async-runner (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 993c282c40085606e14525d46841a996c7a8dcd50109db7828093a3d60254942 Any computer that has this package installed or running should be considered...
CVE-2024-47124
The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous versions of the app and update your app to the current app version which uses AES-256 encryption for callsigns in encrypted operation...
CVE-2022-25507
FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting XSS vulnerability via the Callsign parameter...
CVE-2025-32885
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message into existing v1 networks with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in an unencrypted...
CVE-2024-48259
Cloudlog 2.6.15 allows Oqrs.php requestform SQL injection via stationid or callsign...
CVE-2024-48259
Cloudlog 2.6.15 allows Oqrs.php requestform SQL injection via stationid or callsign...
CVE-2024-48259: Improper Neutralization of Special Elements used in an SQL Command
Cloudlog 2.6.15 allows Oqrs.php requestform SQL injection via stationid or callsign...
CVE-2024-48259
Cloudlog 2.6.15 allows Oqrs.php requestform SQL injection via stationid or callsign...
CVE-2024-48259
The self-hosted PHP application Cloudlog version 2.6.15 is vulnerable to SQL injection due to unsanitized input in the Oqrs.php page's request_form function. Attackers can execute arbitrary SQL commands by sending a crafted request using the station_id or callsign parameters. This could lead to u...
