PT-2020-13287

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9 Description The issue allows remote attackers to upload image files via the "/index.php" API endpoint, potentially leading to unauthorized access or data modification. Recommendations For ismartgate PRO version...

PT-2020-13286

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9 Description The issue allows remote attackers to upload sound files via the "/index.php" API endpoint, potentially leading to unauthorized access or data modification. Recommendations For ismartgate PRO version...

CVE-2020-8887: Improper Neutralization of Special Elements used in an SQL Command

Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker to dump database contents via the page parameter in a page=login request to index.php aka the server login page...

CVE-2020-25515: Unrestricted Upload of File with Dangerous Type

Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books New Book , http:// /lms/index.php?page=books...

B-swiss 3 Digital Signage System 3.6.5 Backdoor Remote Code Execution

Summary Intelligent digital signage made easy. To go beyond the possibilities offered, b-swiss allows you to create the communication solution for your specific needs and your graphic charter. You benefit from our experience and know-how in the realization of your digital signage project...

CVE-2020-25751: Improper Neutralization of Special Elements used in an SQL Command

The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=compago&view=comments filterpublished parameter...

PT-2020-16184

Name of the Vulnerable Software and Affected Versions paGO Commerce plugin version 2.5.9.0 for Joomla! Description The issue allows SQL Injection via the "administrator/index.php?option=com pago&view=comments" API endpoint, specifically through the filter published parameter. Recommendations For...

Projectworlds House Rental SQL Injection Vulnerability

Projectworlds House Rental is a system used by the Projectworlds organization for house rental functionality. version 1.0 of Projectworlds House Rental is vulnerable to SQL injection, which can be exploited by remote attackers to make POST requests via a malicious index.php...

CVE-2020-23833

Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting webserver via a malicious index.php POST request...

CVE-2020-23833: Improper Neutralization of Special Elements used in an SQL Command

Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting webserver via a malicious index.php POST request...

PT-2020-15591

Name of the Vulnerable Software and Affected Versions Projectworlds House Rental version 1.0 Description The issue allows remote attackers to execute arbitrary code on the hosting webserver. This is achieved through an unauthenticated SQL Injection vulnerability via a malicious index.php POST...

CVE-2020-23839

A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...

PT-2020-15589

Name of the Vulnerable Software and Affected Versions SourceCodester Stock Management System version 1.0 Description A Reflected Cross-Site Scripting XSS issue in the index.php login-portal webpage allows remote attackers to harvest login credentials and session cookies when an unauthenticated...

CVE-2020-23839: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...

CVE-2020-23831: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and session cookies when an unauthenticated victim clicks on a malicious URL and enters credentials...

CVE-2020-23835: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 allows remote attackers to harvest keys pressed by an unauthenticated victim who clicks on a malicious URL and begins typing...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

Sql injection

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-6637

OpenSIS Community Edition 7.3 is affected by CVE-2020-6637: a SQL injection through the USERNAME parameter in index.php. The Nuclei template confirms SQLi in OpenSIS 7.3 and describes the impact as the ability to execute arbitrary SQL queries, potentially leading to data access or manipulation. T...