CVE-2022-1833

CVE-2022-1833 affects Red Hat AMQ Broker Operator 7.9.4 installed via UI (OperatorHub). A low-privilege user in the operator namespace can gain cluster-wide edit rights by checking secrets, due to an over-privileged service account used for building the Operator. Exploitation requires an already ...

CVE-2022-1833: Incorrect Default Permissions

A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Operator is deployed has access to clusterwide edit rights by checking the secrets. The service account used for building the Operator gives...

CVE-2022-31356

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=...

CVE-2022-31357

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=...

CVE-2022-31357

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=...

CVE-2022-31356

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=...

Online Ordering System SQL注入漏洞

Online Ordering System is a multi-store ordering system that can be used by any small business.An SQL injection vulnerability exists in Online Ordering System version v2.3.2, which originates from /ordering/admin/inventory/index.php?view=edit & id=Lack of validation of external input SQL statemen...

CVE-2022-31357: Improper Neutralization of Special Elements used in an SQL Command

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=...

CVE-2022-31356: Improper Neutralization of Special Elements used in an SQL Command

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=...

Online Ordering System SQL注入漏洞

Online Ordering System is a multi-store ordering system that can be used by any small business. an SQL injection vulnerability exists in Online Ordering System version v2.3.2, which originates from /ordering/admin/store/index.php?view=edit&id= Lack of validation of external input SQL statements c...

CVE-2021-36608

Cross Site Scripting XSS vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php...

CVE-2020-35597

Victor CMS 1.0 is vulnerable to SQL injection via cid parameter of admineditcomment.php, pid parameter of admineditpost.php, uid parameter of adminedituser.php, and edit parameter of adminupdatecategories.php...

CVE-2020-35597

Victor CMS 1.0 is vulnerable to SQL injection via cid parameter of admineditcomment.php, pid parameter of admineditpost.php, uid parameter of adminedituser.php, and edit parameter of adminupdatecategories.php...

amq: AMQ Broker Operator ClusterWide Edit Permissions Due Token Exposure

A flaw was found in AMQ Broker Operator, installed via UI using the OperatorHub. In this vulnerability, a low-privilege user with access to the Operator deployed namespace has access to cluster-wide edit rights. This flaw allows an attacker to have full cluster management access...

Victor CMS SQL注入漏洞

Victor CMS is an open source content management system by Victor Alagwu, an individual developer in Nigeria. A security vulnerability exists in version 1.0 of Victor CMS that stems from problems with the cid parameter of admineditcomment.php, the pid parameter of admineditpost.php, the uid...

webTareas 跨站脚本漏洞

webTareas is a web-based open source collaboration tool. The product supports project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas version 2.2p1, which originated from a cross-site scripting vulnerability found in the Name field...

CVE-2022-24004

A Stored Cross-Site Scripting XSS vulnerability was discovered in Messenger/messengerajax.php in REDCap 12.0.11. This issue allows any authenticated user to inject arbitrary code into the messenger title aka newtitle field when editing an existing conversation. The payload executes in the browser...

CVE-2022-32302

Theme Park Ticketing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editticket.php...

Sql injection

Theme Park Ticketing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editticket.php...

Theme Park Ticketing System SQL注入漏洞

Sourcecoester Theme Park Ticketing System is an application. A simple PHP/MySQLi project that helps manage and generate tickets for theme park or amusement park visitors. sourcecoester Theme Park Ticketing System v1.0 is vulnerable to a SQL injection vulnerability, which stems from a missing...