Small CRM /admin/edit-user.php File SQL Injection Vulnerability

Small CRM is a customer relationship management system. Small CRM suffers from a SQL injection vulnerability, which originates from an SQL injection vulnerability in the id parameter of the /admin/edit-user.php file. An attacker can exploit this vulnerability to obtain sensitive information or...

PHPGurukul Small CRM 注入漏洞

Small CRM is a customer relationship management system. Small CRM suffers from a SQL injection vulnerability, which originates from an SQL injection vulnerability in the id parameter of the /admin/quote-details.php file. An attacker can exploit this vulnerability to obtain sensitive information o...

PT-2024-38941 · WordPress · S2Member

Name of the Vulnerable Software and Affected Versions: s2Member plugin for WordPress versions up to, and including, 241114 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including user data and database configuration...

The vulnerability of the ThinManager application management platform, developed by Rockwell Automation, arises from the possibility of sending queries to the database without going through authentication procedures. This allows attackers to make changes to the database.

The vulnerability of the Rockwell Automation ThinManager platform’s centralized application management interface lies in the ability to send requests to the database without going through authentication procedures. Exploiting this vulnerability allows a malicious actor to make changes to the...

CVE-2024-10440

The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and delete database contents...

CVE-2024-9921

The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify and delete database contents...

CVE-2024-6796

In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content...

CVE-2024-6795 Vulnerability in Baxter Connex Health Portal

In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database. An attacker could have submitted a crafted payload to Connex portal that could have resulted in...

SQL Injection

github.com/stashapp/stash is vulnerable to SQL Injection. The vulnerability is caused due to not validating the values provided in the sort parameter while executing SQL query. This can lead to attacker retrieving data from database or can change values in the database tables...

Jieshun JieLink+ JSOTC2016 访问控制错误漏洞

Jieshun JieLink+ JSOTC2016 is an intelligent terminal operating platform from China's Jieshun Jieshun Corporation. An access control error vulnerability exists in Jieshun JieLink+ JSOTC2016 20240805 and earlier versions, which stems from the presence of sensitive information disclosure. A malicio...

Jieshun JieLink+ JSOTC2016 访问控制错误漏洞

Jieshun JieLink+ JSOTC2016 is an intelligent terminal operating platform from China's Jieshun Jieshun Corporation. An access control error vulnerability exists in Jieshun JieLink+ JSOTC2016 20240805 and earlier versions, which stems from the presence of sensitive information disclosure. A malicio...

CVE-2024-7731

The CVE-2024-7731 issue affects the SECOM Dr.ID Access Control System. Affected product: Dr.ID Access Control System from SECOM. Root cause: improper validation of a specific page parameter leads to SQL injection. Impact: unauthenticated remote attackers can read, modify, and delete database cont...

SECOM Dr.ID Access Control System SQL注入漏洞

SECOM Dr.ID Access Control System is an access control system of China Zhongbao SECOM Corporation. A SQL injection vulnerability exists in SECOM Dr.ID Access Control System versions prior to 3.5.0.0.0.5, which stems from the presence of specific page parameters that are not properly validated,...

Xibo CMS SQL注入漏洞

Xibo CMS is an open source content management system from Xibo Digital Signage. Xibo CMS suffers from a SQL injection vulnerability that originates from allowing an authenticated user to retrieve and modify arbitrary data from the database by injecting a specially crafted value into the sortBy...

CVE-2024-7201

The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents...

CVE-2024-22059

A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete information in the underlying database. This may also lead to DoS...

CVE-2024-4609 Rockwell Automation Datalog Function within in FactoryTalk® View SE contains SQL Injection Vulnerability

A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploited, the attack could result in...

CVE-2024-31460

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in createallheadernodes function from lib/apiautomation.php , finally resulti...

CVE-2024-31460

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in createallheadernodes function from lib/apiautomation.php , finally resulti...

CVE-2024-31460

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in createallheadernodes function from lib/apiautomation.php , finally resulti...