Centreon SQL注入漏洞

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . A SQL injection vulnerability exists in Centreon v20.10.18, which stems from the escname Escalation Name parameter of its Configuration/Notifications/Escalations component Lack of...

Wedding Planner SQL注入漏洞

Wedding Planner is a wedding planner program. Designed to provide users with an easy way to plan their wedding through a web application while using real data. Wedding Planner v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of the id parameter in...

Wedding Planner SQL注入漏洞

Wedding Planner is a wedding planner project. Designed to provide users with an easy way to plan their wedding through a web application while using real data, Wedding Planner v1.0 is vulnerable to a SQL injection vulnerability that stems from a missing validation of externally entered SQL...

Fake Indian Banking Rewards Apps Targeting Android Users with Info-stealing Malware

An SMS-based phishing campaign is targeting customers of Indian banks with information-stealing malware that masquerades as a rewards application. The Microsoft 365 Defender Research Team said that the messages contain links that redirect users to a sketchy website that triggers the download of t...

PT-2022-25286 · WordPress · Testimonial Slider

Name of the Vulnerable Software and Affected Versions: GS Testimonial Slider plugin versions prior to 1.9.7 Description: The issue concerns multiple authenticated Stored Cross-Site Scripting XSS vulnerabilities. This means that an attacker with contributor or higher privileges can inject maliciou...

Online Pet Shop We App SQL注入漏洞

Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Online Pet Shop We App version 1.0, which originates from a lack of validation of externally entered SQL statements in the...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A SQL injection vulnerability exists in ZZCMS version 2022, which originates from /admin/sendmailto.php?tomail=&groupid= lack of validation of externally entered SQL statements. An attacker can exploit the vulnerability to execu...

Online Pet Shop We App SQL注入漏洞

Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Online Pet Shop We App version 1.0, which originates from a lack of validation of externally entered SQL statements in the...

Pimcore 跨站脚本漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A cross-site scripting vulnerability exists in...

PT-2022-23833 · Unknown · Alton Management System

Name of the Vulnerable Software and Affected Versions: Loan Management System version 1.0 Description: The Loan Management System has a persistent cross-site scripting issue. This means that an attacker can inject malicious scripts into the system, which will be executed by other users' browsers,...

PT-2022-24317 · Unknown · Tastyigniter

Name of the Vulnerable Software and Affected Versions: TastyIgniter version 3.5.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload, which is a result of a cross-site scripting XSS vulnerability. This means an attacker can inject malicious...

Ruby on Rails: ActionView sanitize helper bypass leading to XSS using SVG tag.

An HTML sanitization bypass vulnerability was discovered in the ActionView sanitize helper. This allowed an attacker to bypass sanitization and execute cross-site scripting XSS attacks by using the use tag of the SVG element. By embedding a base64 encoded SVG with malicious code, an attacker coul...

NoSQL Injection Authentication Bypass

A NoSQL injection occurs when a value originating from the client's request is used within a NoSQL call without prior sanitisation. This can allow cyber-criminals to execute arbitrary NoSQL code and thus steal data, or use the additional functionality of the database server to take control of...

Prynt Stealer Contains a Backdoor to Steal Victims' Data Stolen by Other Cybercriminals

Researchers discovered a private Telegram channel-based backdoor in the information stealing malware, dubbed Prynt Stealer, which its developer added with the intention of secretly stealing a copy of victims' exfiltrated data when used by other cybercriminals. "While this untrustworthy behavior i...

CVE-2022-36552

Tenda AC6AC1200 v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request...

CVE-2022-36552

Tenda AC6AC1200 v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request...

CVE-2022-36552

Tenda AC6AC1200 v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request...

Input validation

Tenda AC6AC1200 v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request...

CVE-2022-36552

Tenda AC6AC1200 v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request...

PT-2022-23462 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6AC1200 v5.0 Firmware versions v02.03.01.114 and below Description: The issue affects the /cgi-bin/DownloadFlash component, allowing attackers to steal data such as source code and system files via a crafted GET request...