KLiK SocialMediaWebsite SQL注入漏洞

KLiK SocialMediaWebsite is a simple PHP based social media website by Muhammad Saad personal developer. KLiK SocialMediaWebsite v1.0.1 suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in "profile.php". The vulnerability can be...

CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files

If anonymous read enabled, it's possible to read the database file directly without logging in...

PT-2022-10672 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart version 3.0.3.7 Description: The issue allows users to obtain database information or read server files through SQL injection in the background. This can potentially lead to unauthorized access to sensitive data. Recommendations: For...

CVE-2022-39275 Improper object type validation in saleor

Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following...

Wedding Planner SQL注入漏洞

Wedding Planner is a wedding planner project by pushpam abhishek. Designed to provide users with an easy way to plan their wedding through a web application while using real data. Wedding Planner v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of externally...

Wedding Planner SQL注入漏洞

Wedding Planner is a wedding planner project by pushpam abhishek. Designed to provide users with an easy way to plan their wedding through a web application while using real data. Wedding Planner v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of externally...

Authorization Bypass

iotdb-server is vulnerable to authorization bypass. The vulnerability exists because the library does not properly handle privileges for the internal interfaces, leading to exposure to the database's internal structure...

WordPress plugin JoomSport SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin JoomSport - for Sports: Te...

CVE-2022-38370 No authorization of DatabaseConnectController in grafana-connector.

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue...

PT-2022-24393 · Apache · Apache Iotdb Grafana-Connector

Name of the Vulnerable Software and Affected Versions: Apache IoTDB grafana-connector version 0.13.0 Description: The issue is related to an interface without authorization in the Apache IoTDB grafana-connector, which may expose the internal structure of a database. Recommendations: For Apache...

Major Database Mess Up Leaves Indian Federal Police and Banking Records Exposed

By Deeba Ahmed In total, the publically exposed Elasticsearch database contained a whopping 335 million records or roughly 24GB worth of highly sensitive data. This is a post from HackRead.com Read the original post: Major Database Mess Up Leaves Indian Federal Police and Banking Records Exposed...

Product Show Room Site SQL注入漏洞

Product Show Room Site is a product showroom site from Carlo Montero's personal developer. version 1.0 of Product Show Room Site is vulnerable to SQL injection, which originates from /psrs/classes/Master.php?f=deletecategory The page lacks validation for external input SQL statements, which can b...

CVE-2022-1768

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the /rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive...

CVE-2022-32021

Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/managemovement.php?id=...

Online Car Wash Booking System SQL注入漏洞

Online Car Wash Booking System is an online car wash booking system from Carlo Montero. v1.0 of Online Car Wash Booking System is vulnerable to SQL injection, which originates from /ocwbs/admin/services/ manageservice.php?id=The page lacks validation for external input SQL statements, which can b...

CVE-2021-37413

GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login...

Air Cargo Management System SQL注入漏洞

Air Cargo Management System is an air cargo management system. version 1.0 of Air Cargo Management System is vulnerable to SQL injection, which originates from /acms/classes/Master.php?f=deletecargo missing filtering and An attacker can use this vulnerability to execute illegal SQL commands to...

CSZ CMS SQL注入漏洞

CSZ CMS is a PHP-based open source content management system CMS. version 1.2.9 of CSZ CMS is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in the fieldS and orderby parameters in endpoint/admin/export/getcsv/articledb, which can be used by...

CVE-2021-45491

3CX System through 2022-03-17 stores cleartext passwords in a database...

PT-2022-13466 · Mcafee · Mcafee Enterprise Epolicy Orchestrator

Name of the Vulnerable Software and Affected Versions: McAfee Enterprise ePolicy Orchestrator versions prior to 5.10 Update 13 Description: A blind SQL injection issue allows a remote authenticated attacker to potentially obtain information from the database, with the data obtained being dependen...