744 matches found
Delta Electronics DIAEnergie GetDIAE_usList SQL Injection Vulnerability
Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, Taiwan, China. Delta Electronics DIAEnergie GetDIAEusList suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end...
PT-2024-12436
Name of the Vulnerable Software and Affected Versions Sourcecodester Lost and Found Information System version 1.0 Description The issue is related to unauthenticated SQL Injection. The vulnerability can be exploited at the API endpoint "?page=items/view&id=". This allows for potential manipulati...
PT-2024-20275 · Unknown · Crmeb Java
Name of the Vulnerable Software and Affected Versions: crmeb java versions prior to 1.3.4 Description: The issue allows attackers to execute arbitrary SQL commands by sending a crafted GET request to the "api/front/spread/people" endpoint. This enables attackers to manipulate the database,...
Sql injection
EC-WEB FS-EZViewerWeb's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo...
Sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System up to 1.1. Affected is an unknown function of the file add-category.php. The manipulation of the argument category leads to sql injection. The exploit has been disclosed to the public and...
SQL Injection
net.mingsoft: ms-mcms is vulnerable to SQL Injection. The vulnerability exists via the category Type parameter within /content/list.do, which allows an attacker to manipulate the backend database by injecting malicious SQL commands...
CVE-2023-51700
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting...
Deserialization of untrusted data
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting...
CVE-2023-51700
The CVE-2023-51700 entry concerns the WordPress plugin WP-Mobile-BankID-Integration (Unofficial Mobile BankID Integration) prior to version 1.0.1. The vulnerability is Deserialization of Untrusted Data via PHP Object Injection resulting from insecure serialization/deserialization of OrderResponse...
CVE-2023-48433
Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginaction.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-45725
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output,...
CVE-2023-45725 Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output,...
Adobe RoboHelp Server SQL Injection Vulnerability
Adobe RoboHelp Server is a server-based application for FrameMaker and RoboHelp enterprise users. An SQL injection vulnerability exists in Adobe RoboHelp Server. An attacker could use this vulnerability to view, add, modify, or delete information in the back-end database...
PT-2023-30691 · Unknown · Simple Crud Functionality
Name of the Vulnerable Software and Affected Versions: Simple CRUD Functionality version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the title parameter in the "add.php" file. This can lead to unauthorized access and manipulation of database content...
PT-2023-23449 · Endonesia · Endonesia
Name of the Vulnerable Software and Affected Versions: eNdonesia version 8.7 Description: The issue allows an attacker to execute arbitrary SQL commands via the rid= parameter in the "diskusi.php" file. This enables the attacker to manipulate the database, potentially leading to unauthorized data...
CVE-2023-36256
The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is...
CVE-2023-29759
An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files...
CVE-2023-29759
An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the database files...
