CVE-2022-31991: Improper Neutralization of Special Elements used in an SQL Command

Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=deletecourt...

CVE-2022-31990: Improper Neutralization of Special Elements used in an SQL Command

Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=deleteproduct...

CVE-2022-31946: Improper Neutralization of Special Elements used in an SQL Command

Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=deleteteam...

CVE-2022-31346: Improper Neutralization of Special Elements used in an SQL Command

Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=deleteservice...

GHSA-MP46-7X6Q-F28M Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled

When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfilteredhtml is disabled...

Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled

When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfilteredhtml is disabled...

Deserialization of Untrusted Data in Spring Batch

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means...

CVE-2022-30463: Improper Neutralization of Special Elements used in an SQL Command

Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=deleteproduct...

CVE-2022-30460: Improper Neutralization of Input During Web Page Generation

Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting XSS via /sns/classes/Users.php?f=save, firstname...

CVE-2022-30462: Improper Neutralization of Input During Web Page Generation

Water-billing-management-system v1.0 is affected by: Cross Site Scripting XSS via /wbms/classes/Users.php?f=save, firstname...

CVE-2022-30461: Improper Neutralization of Special Elements used in an SQL Command

Water-billing-management-system v1.0 is vulnerable to SQL Injection via /wbms/classes/Master.php?f=deleteclient, id...

CVE-2022-30838: Improper Neutralization of Special Elements used in an SQL Command

Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=updateapplicationstatus...

CVE-2022-30456: Improper Neutralization of Input During Web Page Generation

Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting XSS via /bcms/classes/Master.php?f=savecourtrental...

CVE-2022-30842: Improper Neutralization of Input During Web Page Generation

Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting XSS via /ctpms/classes/Users.php?f=save, firstname...

CVE-2022-30454: Improper Neutralization of Special Elements used in an SQL Command

Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deleteproduct...

CVE-2022-29304: Improper Neutralization of Special Elements used in an SQL Command

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete Facility...

CVE-2022-29652: Improper Neutralization of Special Elements used in an SQL Command

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=saveclient...

CVE-2022-28962: Improper Neutralization of Special Elements used in an SQL Command

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=deleteclient...

jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based o...

Merchandise Online Store SQL注入漏洞

Merchandise Online Store is a merchandise online store system. A security vulnerability exists in Merchandise Online Store, which can be exploited by attackers via /vloggersmerch/classes/Master.php?f=deleteinventory to conduct SQL injection attack...