Automotive Shop Management System SQL Injection Vulnerability (CNVD-2022-87032)

Automotive Shop Management System is an automotive shop management system by the individual developer Carlo Montero. Automotive Shop Management System v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of externally-entered SQL statements in its...

Automotive Shop Management System SQL Injection Vulnerability (CNVD-2022-87262)

Automotive Shop Management System is an automotive shop management system by the individual developer Carlo Montero. Automotive Shop Management System v1.0 suffers from a SQL injection vulnerability that originates from /asms/admin/?page=user/manageuser&id=Lack of validation of externally entered...

Hospital Management Center SQL Injection Vulnerability

Hospital Management Center is a web system that helps manage healthcare-related information and helps healthcare providers do their jobs efficiently. hospital Management Center is vulnerable to a SQL injection vulnerability that originates in an unknown function in the file patient-info.php Lack ...

Eolinker goku_lite SQL Injection Vulnerability

Eolinker, an API management solution from Eolinker China, is vulnerable to SQL injection, which stems from a lack of validation of external input SQL statements in the file /balance/service/list. An attacker could exploit the vulnerability by gaining access to database information...

Eolinker SQL注入漏洞

Eolinker is an API management solution from Eolinker, a China-based company. Eolinker is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in file/plugin/getList, and can be exploited by attackers to obtain database information...

Delta Electronics Industrial Automation DIALink 路径遍历漏洞

Delta Electronics Industrial Automation DIALink is an industrial automation IoT device from Delta Electronics of Taiwan, China. A path traversal vulnerability exists in Delta Electronics Industrial Automation DIALink because it uses external input to construct a pathname that identifies a file or...

PYSEC-2022-43177

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. T...

UBUNTU-CVE-2022-39327

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. T...

PT-2022-6012

Name of the Vulnerable Software and Affected Versions Azure CLI versions prior to 2.40.0 Description The vulnerability is related to the Azure CLI's command-line interface for Microsoft Azure, which contains a potential code injection issue in versions prior to 2.40.0. This vulnerability can be...

CVE-2022-42889: Keep Calm and Stop Saying "4Shell"

UPDATE 10/18/22: A previous version of this blog indicated that five JDK versions JDK 15+ were not impacted due to the exclusion of the Nashorn JavaScript engine. However, an updated PoC came out that uses the JEXL engine as an exploit path. If JEXL is present, the code executes successfully, so...

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office is an office software suite product from Microsoft Corporation USA. Microsoft Office has a remote code execution vulnerability, which originates from the process of constructing code segments from external input data, the network system or product fails to properly filter the...

Microsoft ODBC Driver Remote Code Execution Vulnerability

Microsoft ODBC Driver is a driver from Microsoft Corporation USA. A remote code execution vulnerability exists in the Microsoft Windows ODBC Driver, which stems from the failure of a network system or product to properly filter special elements of the external input data during the construction o...

The vulnerability of the JXPathContext class functions (except for compile and compilePath) in the JXPath processing library allows a attacker to execute arbitrary code.

The vulnerability of the JXPathContext class functions except for compile and compilePath in the JXPath processing library is related to the use of externally controlled input data for class selection. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Microsoft ODBC Driver 安全漏洞

Microsoft ODBC Driver is a driver from Microsoft Corporation USA. A remote code execution vulnerability exists in the Microsoft Windows ODBC Driver, which stems from the failure of a network system or product to properly filter special elements of the external input data during the construction o...

Microsoft Office 安全漏洞

Microsoft Office is an office software suite product from Microsoft Corporation USA. Microsoft Office has a remote code execution vulnerability, which originates from the process of constructing code segments from external input data, the network system or product fails to properly filter the...

Food Ordering Management System SQL Injection Vulnerability

Food Ordering Management System is a food ordering management system from Carlo Montero's personal developer. The Food Ordering Management System is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements by username, and can be exploited by attackers...

Wedding Planner package_detail.php SQL Injection Vulnerability

Wedding Planner is a wedding planner program. Designed to provide users with an easy way to plan their wedding through a web application while using real data. Wedding Planner v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of the id parameter in...

Wedding Planner wedding_details.php SQL Injection Vulnerability

Wedding Planner is a wedding planner project by pushpam abhishek. Designed to provide users with an easy way to plan their wedding through a web application while using real data. Wedding Planner v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of the id...

Expense Management System SQL注入漏洞

Expense Management System is an expense management system. version v1.0 of Expense Management System is vulnerable to SQL injection, which stems from a lack of validation of external input SQL statements in the id parameter of its /Home/debitcreditp component. An attacker could use this...

Clinic's Patient Management System SQL注入漏洞

Clinic's Patient Management System is a patient management system for clinics. a SQL injection vulnerability exists in Clinic's Patient Management System v1.0, which originates in /pms/ The id parameter in updatepatient.php lacks validation for external input SQL statements. An attacker could use...