CVE-2024-45919

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information ...

CVE-2024-9572

Cross-Site Scripting XSS vulnerability in SOPlanning 1.45, due to lack of proper validation of user input via /soplanning/www/process/groupesave.php, in the groupeid parameter. This could allow a remote user to send a specially crafted query to an authenticated user and steal their session detail...

PT-2024-39693 · Unknown · Esafenet Cdg V5

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG V5 Description: A critical issue has been found in ESAFENET CDG V5, affecting the function delCatelogs of the file /CDGServer3/document/Catelogs;logindojojs?command=DelCatelogs. The manipulation of the argument id leads to SQL...

CVE-2024-9536

A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /MultiServerBackService?path=1. The manipulation of the argument fileId leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2024-46078

itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function deletecategory of the file sportsscheduling/player.php via the argument id...

PT-2024-39634 · Linear · Linear Emerge E3-Series

Name of the Vulnerable Software and Affected Versions: Linear eMerge e3-Series versions 1.00-07 Description: The Linear eMerge e3-Series is vulnerable to an OS command injection issue. A remote and unauthenticated attacker can execute arbitrary OS commands via the login id parameter when invoking...

Nortek Control Linear eMerge E3-Series 安全漏洞

The Nortek Control Linear eMerge E3-Series is an access control from Nortek Control USA. It allows you to specify which doors a person can use to enter and exit a specified location at a specified time. A security vulnerability exists in Nortek Control Linear eMerge E3-Series version 1.00-07 and...

U.S. Dept Of Defense: Cross-Site Scripting (XSS) Vulnerability via parameter c0-id + Akamai Firewall Bypass

A Cross-Site Scripting XSS vulnerability was discovered on a specific website. The vulnerability was found in the POST method, allowing the injection of malicious scripts that could be executed. Exploitation of this vulnerability could have led to consequences such as cookie theft and session...

CVE-2024-46510

CVE-2024-46510 affects ESAFENET CDG v5. The NavigationAjax interface’s id parameter is vulnerable to SQL injection, as stated across multiple connected sources. Root cause: inadequate input validation on the id parameter allows SQL injection. Impact per CVSS: high confidentiality impact, low inte...

CVE-2024-46510

ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax interface...

CVE-2024-46510

ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax interface...

Online Railway Reservation System 访问控制错误漏洞

Online Railway Reservation System is an online railroad reservation system by adminastro individual developers. An access control error vulnerability exists in version 1.0 of the Online Railway Reservation System, which stems from an improper access control issue with the id parameter in the...

Advocate Office Management System SQL注入漏洞

Advocate Office Management System is an office management system by Mayuri K. Individual Developer. A SQL injection vulnerability exists in Advocate Office Management System version 1.0, which originates from an SQL injection vulnerability in the id parameter of the /control/editclient.php page...

CVE-2024-9317

A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function deletecategory of the file /classes/Master.php?f=deletecategory. The manipulation of the argument id leads to sql injection. The attack can be launched...

PT-2024-39567 · Sourcecodester · Sourcecodester Advocate Office Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Advocate Office Management System version 1.0 Description: A critical issue has been found in the system, affecting some unknown functionality of the file /control/activate.php. The manipulation of the id argument leads to SQL...

PT-2024-39553 · Sourcecodester · Sourcecodester Online Railway Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Railway Reservation System version 1.0 Description: A vulnerability was found in the Ticket Handler component, specifically affecting some unknown functionality of the file /?page=tickets. The manipulation of the id...

PT-2024-32068 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the "/admin/doAdminAction.php" API endpoint, specifically when the act parameter is set to delCate and the...

PT-2024-38314 · WordPress · Wordpress Simple Html Sitemap

Name of the Vulnerable Software and Affected Versions: WordPress Simple HTML Sitemap plugin versions up to 3.1 Description: The issue allows authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries, potentially extracting sensitive...

Online Eyewear Shop SQL注入漏洞

Online Eyewear Shop is an online eyewear store by the personal developer Carlo Montero. A SQL injection vulnerability exists in Online Eyewear Shop version 1.0, which stems from the fact that incorrect manipulation of the parameter id can lead to SQL injection...

PT-2024-39415 · Sourcecodester · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical issue has been found in the file view category.php, where the manipulation of the id argument leads to SQL injection. This issue can be exploited remotely. The exploit has...