Taocms SQL注入漏洞

Taocms is a micro Cms content management system in China. a SQL injection vulnerability exists in Taocms v3.0.2, which stems from the lack of validation of external input SQL statements in the id parameter in includeModelCategory.php, and can be exploited by attackers to execute illegal SQL...

CVE-2022-26293

CVE-2022-26293 affects Online Project Time Management System v1.0. The vulnerability is a SQL injection in the id parameter of the save_employee function in /ptms/classes/Users.php, allowing an attacker to manipulate SQL queries. Multiple connected sources confirm the issue and outline the vulner...

CVE-2021-45786

In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...

CVE-2022-25492

HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php...

CVE-2022-25488

Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php...

CVE-2022-25488

Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php...

CVE-2022-25488

Atom CMS v2.0 contains a SQL injection via the id parameter in /admin/ajax/avatar.php. The vulnerability arises from unsafely concatenated SQL in this endpoint, enabling arbitrary SQL execution and potentially data disclosure or modification. Public descriptions from multiple sources corroborate ...

CVE-2022-0321

The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the postid parameter before outputting it back in the response via the wpvcsocialshareicons AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-25006

The MOLIE WordPress plugin through 0.5 does not escape the courseid parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0420

The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rmformid parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks...

CVE-2022-0349

The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nxid parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection...

CVE-2022-23898

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml...

Taocms id parameter SQL injection vulnerability

Taocms is a micro Cms content management system in China. version 3.0.2 of Taocms is vulnerable to SQL injection, which stems from the lack of validation of externally entered SQL statements by the backend parameter id. An attacker can use this vulnerability to execute illegal SQL commands to ste...

CVE-2022-25399

Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

CVE-2022-25399

Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

CVE-2022-25399

Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

Sql injection

Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...

CVE-2022-23380

There is a SQL injection vulnerability in the background of taocms 3.0.2 in parameter id:action=admin&id=2&ctrl=edit...

Home Owners Collection Management System SQL Injection Vulnerability

Home Owners Collection Management System is an owner collection management system. Home Owners Collection Management System contains a SQL injection vulnerability, which originates from the id parameter in the member view member.php, which is found in Home Owners Collection Management System v1.0...

CVE-2022-23912

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...