9811 matches found
CVE-2023-6413: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and...
PT-2023-32649 · Unknown · Voovi Social Networking Script
Name of the Vulnerable Software and Affected Versions: Voovi Social Networking Script version 1.0 Description: A SQL injection vulnerability has been reported, affecting the videos.php endpoint in the id parameter. This could allow a remote attacker to send a specially crafted SQL query to the...
PT-2023-30270 · Unknown · Packers/Movers Management System
Name of the Vulnerable Software and Affected Versions: Packers and Movers Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the "/mpms/admin/?page=user/manage user&id" API endpoint. This is achieved by exploiting a SQL...
CVE-2023-6311
A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects the function deleteltype of the file deleteltype.php of the component Loan Type Page. The manipulation of the argument ltypeid leads to sql injection. The attack may be initiated...
Loan Management System SQL Injection Vulnerability
Loan Management System is a loan management system by razormist individual developers. A SQL injection vulnerability exists in Loan Management System version 1.0, which stems from an incorrect manipulation of the parameter borrowerid that can lead to sql injection...
Best Courier Management System Cross-Site Scripting Vulnerability
Best Courier Management System is a courier management system by Mayuri K. Individual developer. A cross-site scripting vulnerability exists in SourceCodester Best Courier Management System version 1.0, which stems from the presence of an unknown function in the parcellist.php file in the compone...
PT-2023-7504 · D Link · D-Link Dar-7000
Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 up to 20231126 Description: A critical vulnerability has been found in the D-Link DAR-7000, affecting the file /user/inc/workidajax.php. The issue is related to the lack of protection against SQL injection when handling the id...
CVE-2023-2841
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
PT-2023-21698
Name of the Vulnerable Software and Affected Versions Advanced Local Pickup for WooCommerce plugin for WordPress versions up to, and including, 1.5.5 Description The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and...
CVE-2023-2841: Improper Neutralization of Special Elements used in an SQL Command
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
PT-2023-29801 · WordPress · Namaste! Lms
Name of the Vulnerable Software and Affected Versions: Namaste! LMS plugin for WordPress versions up to, and including, 2.6.1.1 Description: The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the course...
Sql injection
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component...
CVE-2023-46582: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component...
CVE-2023-6084
A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/vehicle/checkup/delete.php. The manipulation of the argument VUID leads to sql injection. The exploit has been disclosed to the public and ma...
CVE-2023-47488
Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attribmanagerid parameter in the General Information page and the id parameter in the contact page...
CVE-2023-46788
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter in the 'uploadphoto' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-46785
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partnerpreference.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-33478
RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php...
