Jinher OA SQL注入漏洞

Jinher OA is a collaboration management software from China Jinher Jinher. A SQL injection vulnerability exists in Jinher OA 1.2 and earlier versions, which originates from improper handling of parameters in the /C6/Jhsoft.Web.departments/GetTreeDate.aspx file, which can lead to SQL injection...

O2OA 安全漏洞

O2OA is an enterprise application development platform from O2OA Open Source. A security vulnerability exists in O2OA 10.0-410 and earlier versions, which originates from a cross-site scripting due to incorrect manipulation of the parameters name/alias/description in the file...

O2OA 安全漏洞

O2OA is an enterprise application development platform from O2OA Open Source. A security vulnerability exists in O2OA version 10.0-410 and earlier, which originates from cross-site scripting due to incorrect manipulation of parameters in the file /xportalassembledesigner/jaxrs/widget...

CVE-2025-52970

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges o...

CampCodes Payroll Management System 注入漏洞

CampCodes Payroll Management System is a payroll management system from CampCodes Philippines. An injection vulnerability exists in CampCodes Payroll Management System version 1.0, which stems from improper handling of parameter IDs in the file /ajax.php, which could lead to a SQL injection attac...

RT-Thread 安全漏洞

RT-Thread is an open source IoT real-time operating system RTOS from RT-Thread Open Source. A security vulnerability exists in RT-Thread version 5.1.0, which stems from a null pointer dereference due to the operation of the parameter to in the file rt-thread/components/lwp/lwpsyscall.c. The...

CVE-2020-11812

Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters0value or filters1value parameter...

StudentManager 代码问题漏洞

StudentManager is a student management system developed by huanfenz. A code issue exists in StudentManager version 1.0, the vulnerability stems from improper manipulation of the parameter File in the file /upload/uploadArticle.do, which may result in arbitrary file uploads...

CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...

Raisecom Multi-Service Intelligent Gateway 命令注入漏洞

Raisecom Multi-Service Intelligent Gateway is a Multi-Service Intelligent Gateway from Raisecom China. A command injection vulnerability exists in Raisecom Multi-Service Intelligent Gateway 20250208 and earlier versions, which stems from improper parameter handling, resulting in OS command...

CVE-2024-4320

A remote code execution RCE vulnerability exists in the '/installextension' endpoint of the parisneo/lollms-webui application, specifically within the @router.post"/installextension" route handler. The vulnerability arises due to improper handling of the name parameter in the...

CVE-2024-12311

The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

PT-2024-25371 · Sharp +1 · Multiple Mfps

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to improper processing of some parameters of installed emanual list.html, which leads to a path traversal vulnerability. No...

Prototype Pollution

@saltcorn/server is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of the lang and defstring parameters, allowing modification of the Object prototype, which can lead to remote code execution RCE and SQL injection vulnerabilities...

TMsoft MyAuth Gateway 跨站脚本漏洞

TMsoft MyAuth Gateway is an authentication gateway from TMsoft. A cross-site scripting vulnerability exists in TMsoft MyAuth Gateway 3, which stems from improper manipulation of the parameter console/nocache/cmd and can easily lead to cross-site scripting attacks...

CVE-2024-5334 Local File Read in stitionai/devika

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshotpath' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with...

Tenda AC10U formWifiBasicSet function stack buffer overflow vulnerability

Tenda AC10U is a dual-band Gigabit wireless router from Tenda Technology, designed for 200 megabit and above fiber optic homes, supporting 802.11ac dual-band technology 2.4GHz and 5GHz, with a theoretical WiFi rate of up to 867Mbps. The Tenda AC10U suffers from a stack buffer overflow vulnerabili...

AC Repair and Services System SQL注入漏洞

AC Repair and Services System is an air conditioning repair and services system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in AC Repair and Services System version 1.0, which stems from a misuse of the parameter id resulting in sql injection...

CVE-2021-45478

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2...

CVE-2021-45478

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2...