Authorization Bypass

iotdb-server is vulnerable to authorization bypass. The vulnerability exists because the library does not properly handle privileges for the internal interfaces, leading to exposure to the database's internal structure...

WordPress plugin JoomSport SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin JoomSport - for Sports: Te...

CVE-2022-38370 No authorization of DatabaseConnectController in grafana-connector.

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue...

PT-2022-24393 · Apache · Apache Iotdb Grafana-Connector

Name of the Vulnerable Software and Affected Versions: Apache IoTDB grafana-connector version 0.13.0 Description: The issue is related to an interface without authorization in the Apache IoTDB grafana-connector, which may expose the internal structure of a database. Recommendations: For Apache...

Major Database Mess Up Leaves Indian Federal Police and Banking Records Exposed

By Deeba Ahmed In total, the publically exposed Elasticsearch database contained a whopping 335 million records or roughly 24GB worth of highly sensitive data. This is a post from HackRead.com Read the original post: Major Database Mess Up Leaves Indian Federal Police and Banking Records Exposed...

Product Show Room Site SQL注入漏洞

Product Show Room Site is a product showroom site from Carlo Montero's personal developer. version 1.0 of Product Show Room Site is vulnerable to SQL injection, which originates from /psrs/classes/Master.php?f=deletecategory The page lacks validation for external input SQL statements, which can b...

CVE-2022-1768

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the /rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive...

CVE-2022-32021

Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/managemovement.php?id=...

Online Car Wash Booking System SQL注入漏洞

Online Car Wash Booking System is an online car wash booking system from Carlo Montero. v1.0 of Online Car Wash Booking System is vulnerable to SQL injection, which originates from /ocwbs/admin/services/ manageservice.php?id=The page lacks validation for external input SQL statements, which can b...

CVE-2021-37413

GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login...

Air Cargo Management System SQL注入漏洞

Air Cargo Management System is an air cargo management system. version 1.0 of Air Cargo Management System is vulnerable to SQL injection, which originates from /acms/classes/Master.php?f=deletecargo missing filtering and An attacker can use this vulnerability to execute illegal SQL commands to...

CSZ CMS SQL注入漏洞

CSZ CMS is a PHP-based open source content management system CMS. version 1.2.9 of CSZ CMS is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in the fieldS and orderby parameters in endpoint/admin/export/getcsv/articledb, which can be used by...

CVE-2021-45491

3CX System through 2022-03-17 stores cleartext passwords in a database...

PT-2022-13466 · Mcafee · Mcafee Enterprise Epolicy Orchestrator

Name of the Vulnerable Software and Affected Versions: McAfee Enterprise ePolicy Orchestrator versions prior to 5.10 Update 13 Description: A blind SQL injection issue allows a remote authenticated attacker to potentially obtain information from the database, with the data obtained being dependen...

McAfee Epolicy Orchestrator SQL注入漏洞

McAfee Epolicy Orchestrator McAfee Epo is a U.S. based solution for managing endpoint, network, data security, and compliance. a SQL injection vulnerability exists in versions of McAfee Enterprise ePolicy Orchestrator prior to 5.10 Update 13. The vulnerability stems from the application's lack of...

CVE-2021-25874

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes...

CVE-2021-37807

An SQL Injection vulneraility exists in https://phpgurukul.com Online Shopping Portal 3.1 via the email parameter on the /checkavailability.php endpoint that serves as a checker whether a new user's email is already exist within the database...

webTareas SQL注入漏洞

webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas 2.4 and earlier versions, where an unauthenticated user can perform time and...

CVE-2021-33688

SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions, only some information can be obtained...

Metinfo MetInfo SQL注入漏洞

Metinfo MetInfo is a content management system CMS developed by China's Metinfo using PHP and Mysql. A SQL injection vulnerability exists in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0, which allows attackers to access sensitive database information...