4531 matches found
EGavilan Media Expense-Management-System SQL Injection Vulnerability
EGavilan Media Expense-Management-System is a simple expense management system from EGavilan Media, Inc. An SQL injection vulnerability exists in EGavilan Media Expense-Management-System version 1.0, which stems from vulnerability to SQL injection via / expenseaction.php for SQL injection attacks...
SQL Injection Vulnerability in Car Rental Management System
Car Rental Management System is a car rental management system. SQL injection vulnerability exists in Car Rental Management System, which can be exploited by attackers to view, add, modify or delete information in the back-end database...
ChatBot App with SQL Injection Vulnerability
ChatBot App with Suggestion is a ChatBot application with Suggestion by Carlo Montero's personal developer. v1.0 of ChatBot App with Suggestion is vulnerable to SQL injection, which originates from /simplechatbot/ admin/?page=responses/manageresponse&id=The page lacks validation for external inpu...
CVE-2022-24848 SQL Injection in DHIS2's in OrgUnit program association
DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the /api/programs/orgUnits?programs= API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The system is vulnerable to attack only from...
CVE-2022-24848
DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the "/api/programs/orgUnits?programs=" API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The system is vulnerable to attack only from...
PT-2022-20327
Name of the Vulnerable Software and Affected Versions elitecms version 1.01 Description The issue concerns SQL Injection, which can be exploited via the "/admin/add post.php" API endpoint. This allows for potential unauthorized access to database information. Recommendations For elitecms version...
CVE-2022-30496
SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting to a database to access enterprise's private and sensitive information...
CVE-2022-28862
In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized and unexpected operations against the remo...
GHSA-8FJ6-PC5R-347Q qcubed SQL injection vulnerability in profile.php via the strQuery parameter
A SQL injection vulnerability in qcubed all versions including 3.1.1 in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request...
GHSA-X42G-82PP-4V6G Magento SQL injection vulnerability
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates...
PT-2022-3350
Name of the Vulnerable Software and Affected Versions SAP Adaptive Server Enterprise affected versions not specified SUID-root program affected versions not specified Description The issue is related to a highly privileged user exploiting a SUID-root program to escalate privileges to root on a...
Kaseya VSA SQL Injection Vulnerability
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database...
CVE-2021-37413
GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login...
quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus
A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...
MODX Revolution blind SQL injection
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...
GHSA-PHHM-6PGM-MXW9 MODX Revolution blind SQL injection
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...
Bacula-web SQL Injection Vulnerabilities
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server...
GHSA-XC97-R49Q-CXGC phpMyAdmin Local file inclusion through transformation feature
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has...
