CVE-2023-38846

An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

Cross site request forgery (csrf)

An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

Cross site request forgery (csrf)

An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

Cross site request forgery (csrf)

An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

Cross site request forgery (csrf)

An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

CVE-2023-46347

In the module "Step by Step products Pack" ndksteppingpack version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The method NdkSpack::getPacks has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection...

CVE-2023-26583

Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

CVE-2023-27257

Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by unauthenticated attackers...

CVE-2023-27260

Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

CVE-2023-27254

Unauthenticated SQL injection in the GetRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

CVE-2023-26582

Unauthenticated SQL injection in the GetExcursionDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

CVE-2023-26568

Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

CVE-2023-38848

An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

PT-2023-21041 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns an unauthenticated SQL injection in the GetAssignmentsDue method. This allows unauthenticated attackers to extract or modify all data. Recommendations: For version...

CVE-2023-38849

An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

CVE-2023-38846

An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

PT-2023-26626 · Unknown · Marbre Lapin Line

Name of the Vulnerable Software and Affected Versions: Marbre Lapin Line version 13.6.1 Description: The issue allows a remote attacker to obtain sensitive information via a crafted GET request. Recommendations: For Marbre Lapin Line version 13.6.1, consider restricting access to sensitive...

CVE-2023-38847

The CVE-2023-38847 vulnerability affects CHRISTINA JAPAN Line v13.6.1. A remote attacker can access sensitive information by sending a crafted GET request, with network as the attack vector and no user interaction required. The issue yields Confidentiality impact (C) High, per CVSS metrics (AV:N/...

CVE-2023-38845

An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request...

IDAttend IDWeb Access Control Error Vulnerability

IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in IDAttend IDWeb version 3.1.052 and prior versions, which stems from a lack of authentication in the GetLogFiles method...