6773 matches found
PT-2023-30270 · Unknown · Packers/Movers Management System
Name of the Vulnerable Software and Affected Versions: Packers and Movers Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the "/mpms/admin/?page=user/manage user&id" API endpoint. This is achieved by exploiting a SQL...
VulnCheck KEV: CVE-2022-0747
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the postid parameter before using it in a SQL statement via the qcldupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection...
CVE-2023-6311
A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects the function deleteltype of the file deleteltype.php of the component Loan Type Page. The manipulation of the argument ltypeid leads to sql injection. The attack may be initiated...
Loan Management System SQL Injection Vulnerability
Loan Management System is a loan management system by razormist individual developers. A SQL injection vulnerability exists in Loan Management System version 1.0, which stems from an incorrect manipulation of the parameter borrowerid that can lead to sql injection...
Best Courier Management System Cross-Site Scripting Vulnerability
Best Courier Management System is a courier management system by Mayuri K. Individual developer. A cross-site scripting vulnerability exists in SourceCodester Best Courier Management System version 1.0, which stems from the presence of an unknown function in the parcellist.php file in the compone...
PT-2023-7504 · D Link · D-Link Dar-7000
Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 up to 20231126 Description: A critical vulnerability has been found in the D-Link DAR-7000, affecting the file /user/inc/workidajax.php. The issue is related to the lack of protection against SQL injection when handling the id...
CVE-2023-2841
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
PT-2023-29801 · WordPress · Namaste! Lms
Name of the Vulnerable Software and Affected Versions: Namaste! LMS plugin for WordPress versions up to, and including, 2.6.1.1 Description: The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the course...
Sql injection
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component...
CVE-2023-6084
A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/vehicle/checkup/delete.php. The manipulation of the argument VUID leads to sql injection. The exploit has been disclosed to the public and ma...
CVE-2023-47488
Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attribmanagerid parameter in the General Information page and the id parameter in the contact page...
CVE-2023-46788
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter in the 'uploadphoto' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-46785
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partnerpreference.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-33478
RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php...
Sql injection
RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php...
CVE-2023-42283
Blind SQL injection in apiid parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query...
CVE-2023-33478
RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php...
PT-2023-24353 · Unknown · Remote Clinic
Name of the Vulnerable Software and Affected Versions: RemoteClinic version 2.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability is located in the ID parameter of the "/medicines/stocks.php" API endpoint. Recommendations: For RemoteClinic version 2.0, avoid...