6692 matches found
CVE-2023-40833
An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting...
PT-2023-27661 · Thecosy · Thecosy Icecms
Name of the Vulnerable Software and Affected Versions: Thecosy IceCMS version 1.0.0 Description: The issue allows a remote attacker to gain privileges. This is achieved via the Id and key parameters in the getCosSetting function. Recommendations: For Thecosy IceCMS version 1.0.0, consider...
CVE-2023-2544
Authorization bypass vulnerability in UPV PEIX, affecting the component "pdfcurrinew.php". Through a POST request, an authenticated user could change the ID parameter to retrieve all the stored information of other registered users...
Authorization
Authorization bypass vulnerability in UPV PEIX, affecting the component "pdfcurrinew.php". Through a POST request, an authenticated user could change the ID parameter to retrieve all the stored information of other registered users...
The vulnerability of the delete.php script (located at general/hr/manage/staff_title_evaluation/delete.php) within the Tongda OA automation tool for business processes, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the delete.php script located at general/hr/manage/stafftitleevaluation/delete.php within the Tongda OA automation tool relates to the failure to protect the SQL query structure during the processing of the EVALUATIONID parameter. Exploiting this vulnerability allows an...
Jorani SQL Injection Vulnerability
Jorani is a leave management system developed by Benjamin BALET, an individual developer in France. It is designed to provide small organizations with a simple workflow for leave and overtime requests. A SQL injection vulnerability exists in Jorani version 1.0.0 that originates from allowing an...
CVE-2023-5281
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as critical. This affects an unknown part of the file removeinboxmessage.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has...
CVE-2023-5280
SourceCodester Engineers Online Portal 1.0 contains a SQL injection in my_students.php via the id parameter, allowing remote exploitation. The vulnerability is publicly disclosed (VDB-240908) and can impact confidentiality, integrity, and availability per CVSS metrics; no specific remediation is ...
Tongda OA SQL Injection Vulnerability
Tongda2000 is a web-based intelligent office system from China Tongda Tongda. A SQL injection vulnerability exists in Tongda OA version 2017, which stems from the fact that incorrect manipulation of the TRANSFERID parameter can lead to SQL injection...
Engineers Online Portal SQL Injection Vulnerability
Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. Engineers Online Portal suffers from a SQL injection vulnerability that stems from manipulation of the id parameter that...
PT-2023-31986 · Tongda · Tongda Oa 2017
Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 versions prior to 11.10 Description: A critical issue has been found in Tongda OA 2017, affecting some unknown functionality of the file general/hr/manage/staff transfer/delete.php. The manipulation of the TRANSFER ID argument...
Engineers Online Portal SQL Injection Vulnerability
Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. Engineers Online Portal suffers from a SQL injection vulnerability that stems from manipulation of the id parameter that...
Engineers Online Portal SQL Injection Vulnerability
Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. Engineers Online Portal has a SQL injection vulnerability that stems from manipulation of the teacherid parameter that can...
Engineers Online Portal SQL Injection Vulnerability
Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. Engineers Online Portal suffers from a SQL injection vulnerability that stems from manipulation of the id parameter that...
PT-2023-31994 · Sourcecodester · Sourcecodester Best Courier Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Best Courier Management System version 1.0 Description: A vulnerability was found in the manage parcel status.php file, where the manipulation of the id argument leads to cross-site scripting. The attack can be initiated...
Simple Membership System SQL Injection Vulnerability
Simple Membership System is a simple membership system by Razormist Personal Developer. A SQL injection vulnerability exists in Simple Membership System version 1.0, which stems from the parameter clubid in the file groupvalidator.php that can lead to sql injection...
ECShop SQL Injection Vulnerability
ShopeX ECShop is an open source mall system of the Chinese business school ShopeX company . Support PC + H5 + APP + small program mall , source code free download experience , suitable for enterprise development and build mall . ECShop version 4.1.5 SQL injection vulnerability , the vulnerability...
TONGDA Office Anywhere SQL Injection Vulnerability
TONGDA Office Anywhere is a collaborative office OA system. TONGDA Office Anywhere 2017 suffers from a SQL injection vulnerability that stems from the fact that incorrect operation of the parameter RECRUITMENTID can lead to SQL injection...
PT-2023-31991 · Sourcecodester · Sourcecodester Best Courier Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Best Courier Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file view parcel.php. The manipulation of the id argument leads to sql injection...