Document Management System SQL Injection Vulnerability

Document Management System is a document management system. A SQL injection vulnerability exists in Document Management System version 1.0 due to a lack of validation of externally entered SQL statements in parameter anothercont. An attacker can exploit this vulnerability to execute illegal SQL...

CVE-2024-21184

Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having Execute on SYS.XSDIAG privilege with network access via Oracle Net to compromise...

CVE-2024-6743

AguardNet's Space Management System does not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

SQL Injection in the KubeClarity REST API

Summary A time/boolean SQL Injection is present in the following resource /api/applicationResources via the following parameter packageID Details As it can be seen here, while building the SQL Query the fmt.Sprintf function is used to build the query string without the input having first been...

CVE-2024-6666

WP ERP for WordPress is vulnerable to SQL Injection via vendor_id in versions up to 1.13.0. The flaw stems from insufficient escaping and query preparation, enabling authenticated attackers with Accounting Manager+ permissions (erp_ac_view_sales_summary) to inject additional SQL into existing que...

Unsecured Database Exposed 39 Million Sensitive Legal Records Online

Millions of Legal Documents Exposed Online! Sensitive data leak raises security concerns for the legal industry. Learn how…...

CVE-2024-3604

CVE-2024-3604 affects the OSM – OpenStreetMap WordPress plugin. The Red Hat advisory confirms an authenticated SQL Injection via the 'tagged_filter' parameter of the 'osm_map_v3' shortcode, affecting all versions up to 6.0.2. The vulnerability arises from insufficient escaping of user input and l...

Microsoft SQL Server Security Vulnerability

Microsoft SQL Server is a large commercial database system from Microsoft Corporation USA that is used under Microsoft Windows. A security vulnerability exists in Microsoft SQL Server. An attacker exploiting this vulnerability could remotely execute code. The following products and editions are...

SQL Injection

magento/community-edition is vulnerable to SQL Injection. The vulnerability is due to improper user input sanitization in email templates, allowing an authenticated user with access to these templates to send malicious SQL queries and gain access to sensitive database information...

CVE-2024-3700 Hardcoded password in Estomed Sp. z o.o. Simple Care software

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Simple Care software installations. This issue affects Estomed Sp. z o.o. Simple Care software in all versions. The software is no longer...

CVE-2024-3699

CVE-2024-3699 describes a hard-coded database password used across all drEryk Gabinet installations, allowing retrieval of sensitive patient data. Affected software: drEryk Gabinet versions 7.0.0.0 through 9.17.0.0. According to the available metrics, the vulnerability has a CRITICAL impact (C/H/...

CVE-2024-3699 Hardcoded password in drEryk Gabinet

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all drEryk Gabinet installations.This issue affects drEryk Gabinet software versions from 7.0.0.0 through 9.17.0.0...

CVE-2024-1228 Hardcoded password in Eurosoft Przychodnia

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations. This issue affects Eurosoft Przychodnia software before version 20240417.001 from that version...

CVE-2024-36082

SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Information stored in the database may be obtained or altered by the attacker...

CVE-2024-36082

CVE-2024-36082 applies to Music Store – WordPress eCommerce. Affected versions are prior to 1.1.14. The vulnerability is an SQL Injection in the plugin’s admin-accessible context, allowing an authenticated attacker with Administrative privileges to execute arbitrary SQL commands, potentially read...

JVN#79213252: WordPress Plugin "Music Store - WordPress eCommerce" vulnerable to SQL injection

WordPress Plugin "Music Store - WordPress eCommerce" provided by CodePeople contains an SQL injection vulnerability CWE-89. Impact A user of the product with the administrator privilege may execute an arbitrary SQL command. Information stored in the database may be obtained or altered by the user...

WP TripAdvisor Review Slider < 12.7 - Authenticated (Administrator+) SQL Injection

Description The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 12.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticate...

Dino Physics School Assistant SQL注入漏洞

Dino Physics School Assistant is an application. A SQL injection vulnerability exists in Dino Physics School Assistant version 2.3, which originates from unrecognized code in /admin/category/viewcategory.php, which leads to SQL injection via the parameter id...

PT-2024-13028 · Ibm · Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 3.5 through 4.8 Description: The issue allows a user with access to the Kubernetes pod to make system calls, compromising the security of containers...

J2EEFAST SysOperLogMapper.xml File SQL Injection Vulnerability

J2eeFAST is a Java EE enterprise-class rapid development platform , is committed to building the best small and medium-sized open source free back-end framework platform . J2EEFAST v2.7.0 version of the SQL injection vulnerability , the vulnerability stems from the SysOperLogMapper.xml findPage...