Acronis Snap Deploy Elevation of Privilege Vulnerability

Acronis Snap Deploy is a platform for bulk deployment of system images from Acronis. Acronis Snap Deploy is vulnerable to an elevation of privilege vulnerability that could be exploited by an attacker to cause a local elevation of privilege...

GHSA-WXG6-F773-G2F7 jQuery File Upload Plugin Unrestricted file upload vulnerability

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...

Air Cargo Management System SQL Injection Vulnerability (CNVD-2022-58093)

Air Cargo Management System, an air cargo management system, is vulnerable to a SQL injection vulnerability in version 1.0 of Air Cargo Management System, which originates from /acms/admin/cargotypes/managecargotype.php?id= Lack of filtering and escaping of parameters can be exploited to execute...

Merchandise Online Store SQL Injection Vulnerability (CNVD-2022-40273)

Merchandise Online Store is a merchandise online store system. merchandise Online Store has a security vulnerability that can be exploited by attackers to conduct SQL injection attacks via /vloggersmerch/?p=viewproduct&id=...

Hospital Management System SQL Injection Vulnerability (CNVD-2022-74159)

Hospital Management System HMS is a computer system that helps manage healthcare-related information and helps healthcare providers do their jobs efficiently. hospital Management System v1.0 is vulnerable to SQL injection, which can be exploited by attackers via the SQL injection via the deli...

Covid-19 Travel Pass Management System SQL Injection Vulnerability (CNVD-2022-40237)

Covid-19 Travel Pass Management System is a Covid-19 travel pass management system. It provides an online platform for individuals to submit travel passes within the Covid-19 restrictions. The Covid-19 Travel Pass Management System suffers from an SQL injection vulnerability that originates in...

Apple Releases Security Updates for Multiple Products

Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. Note: Apple notes they are aware of a report that states CVE-2022-22675 may have been actively exploited...

Merchandise Online Store SQL Injection Vulnerability (CNVD-2022-40281)

Merchandise Online Store is a merchandise online store system. merchandise Online Store has a security vulnerability that can be exploited by attackers to conduct SQL injection via /vloggersmerch/classes/Master.php?f=deleteorder attack...

Covid-19 Travel Pass Management System SQL Injection Vulnerability

Covid-19 Travel Pass Management System is a Covid-19 travel pass management system. It provides an online platform for individuals to submit travel passes within the Covid-19 restrictions. The Covid-19 Travel Pass Management System suffers from an SQL injection vulnerability that originates in...

CVE-2022-30770

Terminalfour versions 8.3.7, 8.3.x versions prior to version 8.3.8 and r 8.2.x versions prior to version 8.2.18.5 or 8.2.18.2.1 are vulnerable to XSS vulnerability that could be exploited by an attacker to mislead an administrator and steal their credentials...

Insurance Management System SQL Injection Vulnerability (CNVD-2022-85119)

Insurance Management System is an insurance management system from the personal developer Angel Jude Reyes Suarez. Insurance Management System 1.0 is vulnerable to SQL injection, which could be exploited by attackers to obtain information about data in the target system...

MicroStrategy Web SDK Cross-Site Scripting Vulnerability (CNVD-2022-77860)

MicroStrategy Web SDK is a JavaScript library from MicroStrategy, Inc. It interacts with different CARTO APIs to build custom applications on top of deck.gl that utilize vector rendering. MicroStrategy Web SDK version 10.11 and earlier versions contain a cross-site scripting vulnerability that...

Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58668）

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. page=clients/manageclient&id= lacks validation of external input SQL statements, which could be exploited to execute illegal SQL commands to steal sensitive database data...

Emlog Cross-Site Scripting Vulnerability (CNVD-2022-68881)

Emlog is a PHP and MySQL based CMS website building system. A security vulnerability exists in Emlog Pro version 1.2.2 and earlier, which can be exploited by a registered and logged-in attacker to launch cross-site scripting attacks...

InHand Networks InRouter302 Elevation of Privilege Vulnerability

InHand Networks InRouter Series is a series of routers from InHand Networks, U.S.A. An elevation of privilege vulnerability exists in the InHand Networks InRouter302 V3.5.4 release, which could be exploited by an attacker to cause an increase in privileges via a specially crafted HTTP request...

Foxit PDF Reader Doc Object Remote Code Execution Vulnerability (CNVD-2023-07905)

Foxit PDF Reader is a PDF reader from Foxit China.A remote code execution vulnerability exists in the Foxit PDF Reader Doc object, which can be exploited by attackers to execute code in the context of the current process...

Totolink N200RE and N100RE Cross-Site Scripting Vulnerability

Totolink N200RE and Totolink N100RE are routers from Totolink.Totolink N200RE and N100RE are vulnerable to cross-site scripting, which can be exploited by attackers to execute arbitrary web scripts or HTML...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly adde...

HCL Technologies HCL Sametime Information Disclosure Vulnerability

HCL Sametime, a conferencing solution from HCL Technologies, has a security vulnerability in HCL Technologies HCL Sametime version 11.6 that stems from a lack of external URL absorption in FaviconService, which could be exploited by an attacker to specify the external URL where the online meeting...

Simple Client Management System SQL注入漏洞（CNVD-2022-57771）

Simple Client Management System is a simple client management system from Carlo Montero's personal developer. version 1.0 of Simple Client Management System is vulnerable to a SQL injection vulnerability that originates in /cms/admin/?page=user/ The vulnerability is caused by the lack of validati...