SQL Injection Vulnerability in JPress

JPress is a product developed using Java, similar to WordPress. JPress suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in DEDECMS (CNVD-2021-19724)

DEDECMS is a universal tool that allows you to comprehensively manage various sections on your website. DEDECMS has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in Wando Technology's Website Building System

Wando Technology is an information technology company dedicated to enterprise informationization application services, and is an application service provider for enterprises to provide Internet-based business solutions. A SQL injection vulnerability exists in Wando Technology's website builder...

Code injection

An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the admin password. A different password cannot be set because of the implementation in code...

SQL Injection Vulnerability in Water Rights Trading System (CNVD-2021-18285)

Tangshan Liulin Automation Equipment Co., Ltd. is a high-tech enterprise specializing in the research and development, production, sales and system engineering technical services of Internet of Things security communication terminal and intelligent application platform software. There is a SQL...

SQL Injection Vulnerability in Qibo Cloud Micro Distribution

Micro-distribution is a "micro-mall + micro-distribution" social e-commerce marketing platform, based on the spread of the WeChat circle of friends, easily lead thousands of WeChat users together for you to sell goods, sales of goods. Qibo cloud micro distribution SQL injection vulnerability...

SAP HANA Database Signature Validation Improperity Vulnerability

SAP HANA is a set of high-performance real-time data analytics platform from Germany's SAP, which supports users to query and analyze real-time business data. An improper signature validation vulnerability exists in SAP HANA Database versions 1.0 and 2.0. The vulnerability stems from the program...

SQL Injection Vulnerability in Purple File Management System

hereinafter referred to as "Violet Software" is a provider of industry solutions and IT services. A SQL injection vulnerability exists in the Zilight File Management System. An attacker could exploit this vulnerability to obtain sensitive information from the database...

SQL Injection Vulnerability in LUCA OA (Government Edition)

LUCA OA system adopts three-tier structure mode, system development adopts java technology, and the database supports Mysql, SQL Server, Oracle and so on. SQL injection vulnerability exists in LUCA OA Government Edition, which can be exploited by attackers to obtain sensitive information from the...

Shanghai Yijue Network Technology Co., Ltd. website building system suffers from SQL injection vulnerability (CNVD-2021-16460)

The business scope of Shanghai Yijue Network Technology Co., Ltd. includes technical development, technology transfer, technical consultation, technical services in the field of network technology, computer technology, information technology, computer network engineering and so on. Shanghai Yijue...

SQL Injection Vulnerability in Putonghua Intelligent Evaluation and Learning System of KU Xunfei Co.

Ltd. is a company specializing in intelligent speech and language technology research, software and chip product development, voice information service and e-government system integration. A SQL injection vulnerability exists in the Mandarin Intelligent Evaluation and Learning System of KU Xunfei...

SQL Injection Vulnerability in CRM E4/Standard Edition of Pengwei Software Co.

Pengwei Software Co., Ltd. is a static transportation system solution provider. A SQL injection vulnerability exists in the CRM E4/Standard Edition of Pengwei Software Corporation, which can be exploited by attackers to obtain sensitive information from the database...

SQL injection vulnerability in eq***.asp page of website building system of Ningbo Yilong Computer Technology Co.

Ningbo YiLong Computer Technology Co., Ltd. is a design and build enterprise focusing on enterprise website platform, government school, home service and other industries. Ltd. website building system eq.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive...

CVE-2021-22854

The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege...

Sql injection

The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege...

CASAP Automated Enrollment SQL Injection Vulnerability

CASAP Automated Enrollment is an automated enrollment system organized by CASAP USA. The purpose of this project is to provide an automated enrollment system for CASAP to streamline the school process and make it more effective, efficient, and easily retrievable. A SQL injection vulnerability...

SQL Injection Vulnerability in Qibo CMS (CNVD-2021-14441)

Qibo CMS system uses the core + plug-in + channel module system architecture, while then combined with visual labeling technology, can be evolved into a variety of corporate, government, education, units, school websites. Qibo CMS whole site system has a SQL injection vulnerability, attackers can...

Format string

An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product...

CVE-2020-10375

CVE-2020-10375 affects New Media Smarty before 9.10. The issue is that passwords are stored in an obfuscated format that can be easily reversed, with the obfuscated values located in the file data.mdb (second column). This is explicitly noted as unrelated to the popular Smarty template engine pro...

CVE-2020-10538

An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute-forced efficiently and should not be used for such purposes. Additionally, since no salt is used, rainbow tables can speed up the attack...