CVE-2025-40618

The CVE-2025-40618 entry describes an SQL injection in Bookgy, exploitable via the IDRESERVA parameter in /bkg_imprimir_comprobante.php. Affected component: Bookgy web API endpoint; root cause: improper input handling allowing arbitrary SQL access. Implications shown in metrics: high impact on co...

CVE-2025-40618 SQL injection vulnerability in Bookgy

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDRESERVA" parameter in /bkgimprimircomprobante.php...

CVE-2025-40617

CVE-2025-40617 is a SQL injection vulnerability in Bookgy. Reported impact includes the ability to retrieve, create, update, and delete databases via HTTP requests to /bkg_seleccionar_hora_ajax.php using the IDTIPO, IDPISTA, and IDSOCIO parameters. Affected product is Bookgy (no specific version ...

CVE-2025-40617 SQL injection vulnerability in Bookgy

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkgseleccionarhoraajax.php...

CVE-2025-40617 SQL injection vulnerability in Bookgy

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkgseleccionarhoraajax.php...

CVE-2025-40618: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDRESERVA" parameter in /bkgimprimircomprobante.php...

PT-2025-18176

Name of the Vulnerable Software and Affected Versions Bookgy affected versions not specified Description The issue is a SQL injection vulnerability that could allow an attacker to retrieve, create, update, and delete databases by sending an HTTP request through the IDRESERVA parameter in the "/bk...

Planet UNI-NMS-Lite Trust Management Issues Vulnerability

Planet UNI-NMS-Lite is a universal network management system from PLANET China that monitors all deployed wired or wireless PoE industrial grade network devices. Planet UNI-NMS-Lite is vulnerable to a trust management issue that can be exploited by an attacker to submit a special request that can...

CVE-2025-46274

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database...

CVE-2025-46274 Planet Technology Network Products Use of Hard-coded Credentials

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database...

CVE-2025-46274

Planet UNI-NMS-Lite is affected by CVE-2025-46274, a vulnerability arising from hard-coded credentials that could allow an unauthenticated attacker to read, manipulate, and create entries in the managed database. The risk is described as CRITICAL with network attack vector and no user interaction...

PT-2025-17863 · Unknown · Uni-Nms-Lite

Name of the Vulnerable Software and Affected Versions: UNI-NMS-Lite affected versions not specified Description: The issue concerns the use of hard-coded credentials in UNI-NMS-Lite, which could allow an unauthenticated attacker to read, manipulate, and create entries in the managed database...

CVE-2025-32969

Summary: CVE-2025-32969 affects XWiki Platform REST server and related components, enabling unauthenticated remote SQL injection by escaping the HQL execution context in the REST API query endpoint. Affected versions are 1.8 through before 15.10.16, and before 16.4.6 and 16.10.1. Successful explo...

PT-2025-17559

Name of the Vulnerable Software and Affected Versions Jmix versions 1.0.0 through 1.6.1 Jmix versions 2.0.0 through 2.3.4 Description The issue allows attackers to manipulate the fileRef parameter to access files on the system where the Jmix application is deployed, provided the application serve...

CVE-2025-2572

In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup...

PT-2025-16836 · Unknown · Telecontrol Server Basic

Name of the Vulnerable Software and Affected Versions: TeleControl Server Basic versions prior to 3.1.2.2 Description: A SQL injection vulnerability has been identified in the affected application through the internally used UpdateConnectionVariableArchivingBuffering method. This could allow an...

Progress WhatsUp Gold < 24.0.3 Database Manipulation (CVE-2025-2572)

The version of Progress WhatsUp Gold installed on the remote host is prior to 24.0.3. It is, therefore, affected by a database manipulation vulnerability: - In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the...

ABB Cylon Aspect 3.08.03 (CookieDB) - SQL Injection

ABB Cylon Aspect 3.08.03 CookieDB SQL Injection Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.03 Summary: ASPECT is an award-winning scalable building energy management and control soluti...

Exploit for Cross-site Scripting in Jquery

SQL Injection Vulnerability in Advaya GEMS ERP Portal v2.1 ⚠️...

CVE-2025-2572 WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability

In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup...