CVE-2024-10386

CVE-2024-10386 affects Rockwell Automation ThinManager (ThinServer/ThinManager) and is described as an authentication vulnerability that allows a threat actor with network access to send crafted messages to the device, potentially causing database manipulation. Multiple connected sources confirm ...

Rockwell Automation ThinManager 安全漏洞

Rockwell Automation ThinManager is a thin client management software from Rockwell Automation, Inc. It allows thin clients to be assigned to multiple remote desktop servers simultaneously. Rockwell Automation ThinManager has an authentication error vulnerability that can be exploited by an attack...

CVE-2024-10386: Missing Authentication for Critical Function

CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation...

Delta Electronics DIAEnergie AM_RegReport.aspx SQL Injection Vulnerability

Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, Taiwan, China. An SQL injection vulnerability exists in Delta Electronics DIAEnergie AMRegReport.aspx, which can be exploited by an attacker to view, add, modify, or delete information in the back-end...

PT-2024-31897

Name of the Vulnerable Software and Affected Versions: itsourcecode Sports Management System Project version 1.0 Description: The issue is related to a SQL Injection vulnerability in the delete category function of the sports scheduling/player.php file, which can be exploited via the id argument...

PT-2024-38983 · WordPress · Cost Calculator Builder

Name of the Vulnerable Software and Affected Versions: Cost Calculator Builder WordPress plugin versions prior to 3.2.29 Description: The issue is related to a SQL injection vulnerability. It occurs because the plugin does not properly sanitise and escape a parameter before using it in a SQL...

U.S. Dept Of Defense: SQL Injection

The application was found to have a blind SQL injection vulnerability in the 'filterevent' parameter. The vulnerability allowed an attacker to manipulate database queries and extract sensitive information from the database through time-based or boolean-based techniques, as the injection was blind...

CVE-2024-6795

In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database. An attacker could have submitted a crafted payload to Connex portal that could have resulted in...

SportsNET SQL Injection Vulnerability

SportsNET is a sports event network application from SportsNET, Inc. SportsNET suffers from a SQL injection vulnerability that can be exploited by an attacker to retrieve, update, and delete all information in the database via a specially crafted SQL query...

SportsNET SQL Injection Vulnerability (CNVD-2024-37596)

SportsNET is a sports event network application from SportsNET, Inc. SportsNET suffers from a SQL injection vulnerability that can be exploited by an attacker to retrieve, update, and delete all information in the database via a specially crafted SQL query...

SportsNET SQL Injection Vulnerability (CNVD-2024-37597)

SportsNET is a sports event network application from SportsNET, Inc. SportsNET suffers from a SQL injection vulnerability that can be exploited by an attacker to retrieve, update, and delete all information in the database via a specially crafted SQL query...

SQL Injection

centreon/centreon Web is vulnerable to SQL Injection. The vulnerability is due to improper input validation in the updateServiceHost functionality, allowing attackers to inject malicious SQL code, potentially leading to unauthorized access or manipulation of the database...

CVE-2024-8329

CVE-2024-8329 affects Gether Technology’s 6SHR System. The vulnerability is an SQL injection caused by improper validation of the page parameter, exploitable remotely over a network with low privileges and no user interaction. Impact is read/modify/delete of database contents (high confidentialit...

CVE-2024-29723

CVE-2024-29723 corresponds to SQL injection vulnerabilities in SportsNET, affecting version 4.0.1. The issue is exploitable via a crafted SQL query to the API endpoint /conexiones/ax/openTracExt/ using the parameter categoria, which could allow an attacker to retrieve, update, and delete all info...

CVE-2024-29727

SportsNET (version 4.0.1) contains SQL injection vulnerabilities in the /app/ax/sendParticipationRemember/ endpoint (send parameter). The issue could allow an attacker to retrieve, update, and delete all information in the database. A practical description from PT-2024-22971 notes the risk and pr...

CVE-2024-29726: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/setAsRead/, parameter id...

PT-2024-22972

Name of the Vulnerable Software and Affected Versions SportsNET version 4.0.1 Description The issue concerns SQL injection vulnerabilities that could allow an attacker to retrieve, update, and delete all information in the database by sending a specially crafted SQL query. The vulnerable API...

PT-2024-22970

Name of the Vulnerable Software and Affected Versions SportsNET version 4.0.1 Description The issue concerns SQL injection vulnerabilities that could allow an attacker to retrieve, update, and delete all information in the database by sending a specially crafted SQL query to the...

CVE-2024-3279

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...

CVE-2024-3279: Missing Authentication for Critical Function

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...