RuvarOA security vulnerabilities

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /bulletin/bulletintemplateshow.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

RuvarOA security vulnerabilities

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the lack of validation of the fileid parameter of the /CorporateCulture/kaizendownload.aspx file against external SQL input. An attacker can exploit this...

RuvarOA security vulnerabilities

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the lack of validation of the attachid parameter in the /Bulletin/AttachDownLoad.aspx file against external SQL input. An attacker can exploit this...

CVE-2024-32370

HSC Cybersecurity HC Mailinspector versions 5.2.17-3 through 5.2.18 are vulnerable to a flaw in the mliSystemUsers.php component. A remote attacker can exploit this by sending a crafted payload to the id parameter to obtain sensitive information . As a temporary workaround, it is recommended to r...

CVE-2024-25511

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicnew.aspx...

CVE-2024-25511: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicnew.aspx...

CVE-2024-25510: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicshow.aspx...

CVE-2024-25508: Improper Neutralization of Special Elements used in an SQL Command

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletintemplateshow.aspx...

CVE-2024-33407

SQL injection vulnerability in /model/deleterecord.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

CVE-2024-33410

SQL injection vulnerability in /model/deleterangegrade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

CVE-2024-33403

A SQL injection vulnerability in /model/getevents.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the eventid parameter...

CVE-2024-33407: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in /model/deleterecord.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

PT-2024-25243

Name of the Vulnerable Software and Affected Versions campcodes Complete Web-Based School Management System version 1.0 Description The issue allows an attacker to execute arbitrary SQL commands via the id parameter in the "/model/delete range grade.php" API endpoint. This can lead to unauthorize...

CVE-2024-33410: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in /model/deleterangegrade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

PT-2024-25239

Name of the Vulnerable Software and Affected Versions campcodes Complete Web-Based School Management System version 1.0 Description The issue allows an attacker to execute arbitrary SQL commands via the id parameter in the /model/delete record.php API endpoint. This can potentially lead to...

CVE-2024-33408

A SQL injection vulnerability in /model/getclassroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

PT-2024-25240

Name of the Vulnerable Software and Affected Versions campcodes Complete Web-Based School Management System version 1.0 Description A SQL injection issue in the /model/get classroom.php file allows an attacker to execute arbitrary SQL commands via the id parameter. This could potentially lead to...

CVE-2024-33408: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in /model/getclassroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

CVE-2023-38121

Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability i...

CVE-2023-38121: Improper Neutralization of Input During Web Page Generation

Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability i...