318 matches found
CVE-2024-33962
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'code' in...
CVE-2024-33962: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'code' in...
PT-2024-5673 · Unknown · Netcat Netshop Cms
Name of the Vulnerable Software and Affected Versions: Netcat Netshop CMS affected versions not specified Description: The issue exists due to inadequate protection of the web page structure, specifically in the code parameter of the netshop CMS module. This allows a remote attacker to execute...
PT-2024-28903 · Shenzhen Libituo Technology Co. · Lbt-T300-T400
Name of the Vulnerable Software and Affected Versions: Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 version 3.2 Description: A stack overflow issue was discovered via the pin 3g code parameter in the config 3g para function. Recommendations: For version 3.2, avoid using the pin 3g code...
PT-2024-37159 · WordPress · The Houzez Theme
Name of the Vulnerable Software and Affected Versions: The Houzez Theme - Functionality plugin for WordPress versions up to, and including, 3.2.2 Description: The issue is related to SQL Injection via the currency code parameter due to insufficient escaping on the user-supplied parameter and lack...
CVE-2024-3922 Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
PT-2024-28394
Name of the Vulnerable Software and Affected Versions Dokan Pro plugin for WordPress versions up to, and including, 3.10.3 Description The issue allows unauthenticated attackers to perform SQL Injection via the code parameter due to insufficient escaping on the user-supplied parameter and lack of...
Employee and Visitor Gate Pass Logging System SQL Injection Vulnerability
Employee and Visitor Gate Pass Logging System is an employee and visitor pass logging system developed by Carlo Montero, an individual developer. An SQL injection vulnerability exists in Employee and Visitor Gate Pass Logging System version 1.0, which stems from an incorrect operation of the...
CVE-2024-3922: Improper Neutralization of Special Elements used in an SQL Command
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
BossCMS Security Breach
Wenzhou Huoyin Information Technology BossCMS is a content management system based on MySQL architecture of self-developed PHP framework by Wenzhou Huoyin Information Technology. A security vulnerability exists in BossCMS v3.10, which is caused by a cross-site request forgery CSRF vulnerability i...
BlueNet Technology Clinical Browsing System SQL Injection Vulnerability
BlueNet Technology Clinical Browsing System is a clinical browsing system from BlueNet Technology. A SQL injection vulnerability exists in BlueNet Technology Clinical Browsing System version 1.2.1, which stems from an incorrect manipulation of the parameter INSTICODE that can lead to SQL injectio...
CVE-2024-33788
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint...
PT-2024-25115 · Thinksaas · Thinksaas
Name of the Vulnerable Software and Affected Versions: ThinkSAAS version 3.7.0 Description: A stored cross-site scripting XSS vulnerability in the component /pubs/counter.php allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter. This...
CVE-2024-33102: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter...
CVE-2024-33102
The community development system ThinkSAAS v3.7.0 contains a stored cross-site scripting (XSS) vulnerability in the /pubs/counter.php component. Attackers can exploit this by injecting a crafted payload into the code parameter, leading to the execution of arbitrary web scripts or HTML. This vulne...
Vyper security vulnerabilities
Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in Vyper 0.3.10 and earlier versions, which stems from when the buffer parameters are msg.data, self.code, .code, start, length...
CVE-2024-2116: Improper Neutralization of Input During Web Page Generation
The Christmas Greetings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the code parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
PT-2024-18835 · WordPress · Christmas Greetings
Name of the Vulnerable Software and Affected Versions: Christmas Greetings plugin for WordPress versions 1.2.5 and earlier Description: The issue is related to Reflected Cross-Site Scripting via the code parameter due to insufficient input sanitization and output escaping. This allows...
Shenzhen Libituo Technology LBT-T300-mini security vulnerability
The Shenzhen Libituo Technology LBT-T300-mini is a mini-plug-in router from Shenzhen Libituo Technology China. A security vulnerability exists in the Shenzhen Libituo Technology LBT-T300-mini v1.2.9, which is caused by a buffer overflow in the pincode3g parameter in /apply.cgi...
