PT-2023-13354 · Apache · Apache Axis

Name of the Vulnerable Software and Affected Versions: RWS WorldServer versions prior to 11.7.3 Description: An issue was discovered that allows an authenticated, remote attacker to perform a blind SSRF attack using the ws-legacy/load dtd?system id= endpoint to deploy JSP code to the Apache Axis...

CVE-2023-48716

Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'classid' parameter of the addclasses.php resource does not validate the characters received and they are sent unfiltered to the database...

PT-2023-32852 · Unknown · Phpgurukul Online Notes Sharing System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Notes Sharing System version 1.0 Description: A vulnerability was found in the PHPGurukul Online Notes Sharing System, affecting some unknown functionality of the file /user/manage-notes.php of the component Notes Handler. T...

Tongda2000 SQL Injection Vulnerability

Tongda2000 is a network intelligent office system of China Tongda Tongda. Tongda2000 11.9 and previous versions exist SQL injection vulnerability, the vulnerability stems from the existence of an unknown function in general/vehicle/checkup/deletesearch.php, through the parameter VUID lead to SQL...

CVE-2023-5007

Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database...

PT-2023-31448 · Unknown · Hotel Booking Management

Name of the Vulnerable Software and Affected Versions: Hotel Booking Management version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "update.php" endpoint. Recommendations: For Hotel Booking Management...

CVE-2023-6898

A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manageuser.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The...

The vulnerability of the workidajax.php script in the DAR-7000 router microprogramming software allows a hacker to execute arbitrary SQL code and gain increased privileges.

The vulnerability of the workidajax.php script in the DAR-7000 router microprogramming software is related to the lack of measures taken to protect the SQL query structure when processing the id parameter. Exploiting this vulnerability allows an attacker to execute arbitrary SQL code and enhance...

CVE-2023-6658

A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file ajax-api.php?action=saveattendance. The manipulation of the argument classid leads to sql injection. The exploit has been disclosed to the...

PT-2023-32733 · Sourcecodester · Sourcecodester Simple Student Attendance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Simple Student Attendance System. This issue affects an unknown part of the file /modals/student form.php...

PT-2023-32719 · Sourcecodester · Sourcecodester Simple Student Attendance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A critical issue has been found in the attendance.php file, where the manipulation of the class id argument leads to sql injection. The exploit has been disclosed to the...

PT-2023-32721 · Sourcecodester · Sourcecodester Simple Student Attendance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A critical issue affects some unknown functionality of the file /modals/class form.php. The manipulation of the id argument leads to SQL injection. The issue has been...

CVE-2023-6579

A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument estimatecountryid leads to sql injection. Th...

osCommerce SQL注入漏洞

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. An SQL injection vulnerability exists in osCommerce, which originates from the lack of validation of the parameter estimatecountryid in the file /b2b-supermarket/shopping-cart against externally entered...

speedtest Cross-Site Scripting Vulnerability

speedtest is a very lightweight network speed test tool implemented in Javascript. A cross-site scripting vulnerability exists in librespeed speedtest version 5.2.4 and earlier, which stems from the parameter id in the file results/stats.php that causes cross-site scripting...

CVE-2023-6417

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via update.php in the id parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all th...

CVE-2023-6413

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and...

PT-2023-32649 · Unknown · Voovi Social Networking Script

Name of the Vulnerable Software and Affected Versions: Voovi Social Networking Script version 1.0 Description: A SQL injection vulnerability has been reported, affecting the videos.php endpoint in the id parameter. This could allow a remote attacker to send a specially crafted SQL query to the...

PT-2023-30270 · Unknown · Packers/Movers Management System

Name of the Vulnerable Software and Affected Versions: Packers and Movers Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the "/mpms/admin/?page=user/manage user&id" API endpoint. This is achieved by exploiting a SQL...

VulnCheck KEV: CVE-2022-0747

The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the postid parameter before using it in a SQL statement via the qcldupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection...