CVE-2023-49622 Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the materialbill.php?action=itemRelation resource does not validate the characters received and they are sent unfiltered to the database...

PT-2023-31686 · Squirrly · Squirrly Seo - Advanced Pack

Name of the Vulnerable Software and Affected Versions: Squirrly SEO - Advanced Pack versions through 2.3.8 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection'. This allows for potential exploitation by injecting...

My Calendar < 3.4.22 - Unauthenticated SQL Injection

Description The My Calendar plugin for WordPress is vulnerable to blind|generic|time-based SQL Injection via the 'from' and 'to' parameters of the '/my-calendar/v1/events' rest route in all versions up to, and including, 3.4.21 due to insufficient escaping on the user supplied parameter and lack ...

CVE-2023-48723

CVE-2023-48723 is flagged as withdrawn by the CNA. In the connected PT-2023-30926 entry, the affected software is Student Result Management System v1.0, with an unauthenticated SQL Injection vulnerability in add_results.php where the rno parameter is not validated and is sent unfiltered to the da...

CVE-2023-48717

The Connected document PT-2023-30920 documents an unauthenticated SQL Injection in Student Result Management System (SRMS) v1.0. The flaw is in add_classes.php where the class name parameter is not validated or filtered, and input is sent unfiltered to the database, enabling SQL injection. This c...

CVE-2023-45125

The CVE entry CVE-2023-45125 is connected to PT-2023-29424, which describes an Authenticated SQL Injection in Online Examination System version 1.0. The vulnerability arises because the time parameter in update.php is not validated and is sent unfiltered to the database. Impact is not detailed be...

WordPress Plugin Soledad SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Soledad...

CVE-2023-48372

The CVE-2023-48372 entry pertains to ITPison OMICARD EDM. The SMS-related function has insufficient input validation, enabling an unauthenticated remote attacker to inject arbitrary SQL commands to access, modify, and delete database data. This is described across multiple connected records (NVD/...

Sql injection

An issue was discovered in SchedMD Slurm 23.11.x. There is SQL Injection against the SlurmDBD database. The fixed version is 23.11.1...

CVE-2023-49934

CVE-2023-49934 concerns Slurm 23.11.x where an SQL injection against the SlurmDBD database is possible. The issue affects SlurmDBD processing and is mitigated by upgrading to Slurm 23.11.1, which contains the fix. The NVD metrics indicate a critical impact (CVSS v3.1: CVSS:3.1, AV:N/AC:L/PR:N/UI:...

CVE-2023-41120

An issue was discovered in EnterpriseDB Postgres Advanced Server EPAS before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It permits an authenticated user to use DBMSPROFILER to remove all accumulated profiling data on a system-wide basis,...

WordPress Bravo Translate 1.2 SQL Injection Vulnerability

Exploit Title: WP Plugins Bravo Translate = 1.2 - SQL Injection Exploit Author: Arvandy Software Link: https://wordpress.org/plugins/bravo-translate/ Version: 1.2 Tested on: Windows, Linux CVE: CVE-2023-49161 Product Description This plugin allow you to translate your monolingual website in a sup...

CVE-2023-5869

CVE-2023-5869 (PostgreSQL) : A flaw in PostgreSQL enables authenticated database users to execute arbitrary code via missing overflow checks during SQL array value modification, caused by an integer overflow when modifying arrays. The described impact includes arbitrary write/read of memory and p...

PT-2023-30991 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS version 3.9 Description: The issue is related to SQL Injection due to the lack of security checks on the input of the application. An attacker can inject malicious SQL commands into the background database engine for execution, sending...

CVE-2023-29065 Overly Permissive Access Policy

The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database...

CVE-2023-40610

CVE-2023-40610 affects Apache Superset prior to version 2.1.2. The issue is an improper authorization check that enables privilege escalation when using the default examples database connection, which can grant access to both the examples schema and Superset metadata DB. A specially crafted CTE S...

CVE-2023-40610 Apache Superset: Privilege escalation with default examples database

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

CVE-2022-46337 Apache Derby: LDAP injection vulnerability in authenticator

A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was...

CVE-2023-6105

Technical details about CVE-2023-6105 are not publicly provided in the supplied documents; monitor for updates.

Lesson from Casio’s Data Breach: Why Database Security Still a Major Challenge for Businesses?

By Waqas Casio's data breach exposed a well-known secret: no one is immune to cyberattacks - It also exposes the highly vulnerable state of databases. This is a post from HackRead.com Read the original post: Lesson from Casios Data Breach: Why Database Security Still a Major Challenge for...