PT-2024-28253 · Horizon Business Services Inc. · Caterease

Name of the Vulnerable Software and Affected Versions: Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 Description: The issue allows a remote attacker to perform command line execution through SQL Injection due to improper neutralization of special elements used ...

CVE-2024-7371 SourceCodester Simple Realtime Quiz System quiz_view.php sql injection

A vulnerability was found in SourceCodester Simple Realtime Quiz System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /quizview.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The...

CVE-2024-5765

The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

IBM InfoSphere Information Server SQL注入漏洞

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. IBM InfoSphere Information Server version 11.7 suffers from a SQL injection vulnerability that...

Apache StreamPark: FreeMarker SSTI RCE Vulnerability

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...

CVE-2024-29178

Apache StreamPark before version 2.1.4 is affected by a FreeMarker SSTI vulnerability that an authenticated user can exploit to achieve Remote Code Execution on the server. Root cause: template injection via FreeMarker in the application, with high impact (CVE-2024-29178). Remediation: upgrade to...

CVE-2024-6808 itsourcecode Simple Task List signUp.php insertUserRecord sql injection

A vulnerability was found in itsourcecode Simple Task List 1.0. It has been classified as critical. This affects the function insertUserRecord of the file signUp.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

Exploit for Code Injection in Vmware Cloud_Foundation

Privilege Escalation: VMware vCenter Server Authenticated RCE...

VMware Aria Automation Security Vulnerability

VMware Aria Automation is a modern workflow automation platform from VMware that simplifies and automates complex data center infrastructure tasks to improve scalability and agility. A security vulnerability exists in VMware Aria Automation that stems from a failure to apply proper input...

WordPress plugin WooCommerce injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An injection...

Vanna Code Issue Vulnerability

Vanna is a personalized AI SQL agent from Vanna Inc. Vanna version v0.3.4 suffers from a code issue vulnerability that stems from vulnerability to SQL injection attacks, where an attacker can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the...

Prompt Injection Flaw in Vanna AI Exposes Databases to RCE Attacks

Cybersecurity researchers have disclosed a high-severity security flaw in the Vanna.AI library that could be exploited to achieve remote code execution vulnerability via prompt injection techniques. The vulnerability, tracked as CVE-2024-5565 CVSS score: 8.1, relates to a case of prompt injection...

PT-2024-37331 · WordPress · Quiz Maker

Name of the Vulnerable Software and Affected Versions: Quiz Maker plugin for WordPress versions up to, and including, 6.5.8.3 Description: The issue is related to time-based SQL Injection via the ays questions parameter due to insufficient escaping on the user-supplied parameter and lack of...

CVE-2023-49110 XML External Entity Injection in Kiuwan SAST

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application either on-premises or cloud/SaaS solution, the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image zoom. A security vulnerability exists in PrestaShop pkthemesettings 1.8.8 and earlier versions, which stems from the presen...

GO-2024-2799 MCUboot Injection attack of unprotected TLV values in github.com/mcu-tools/mcuboot

MCUboot Injection attack of unprotected TLV values in github.com/mcu-tools/mcuboot...

PT-2024-26457 · Unknown · Diño Physics School Assistant

Name of the Vulnerable Software and Affected Versions: Diño Physics School Assistant version 2.3 Description: A vulnerability has been discovered that impacts an unidentified code within the file /classes/Master.php?f=view category. Manipulating the id argument can result in SQL injection...

Online Student Enrollment System SQL注入漏洞

Online Student Enrollment System is an online student enrollment system by Lyndon Bermoy, an individual developer. A SQL injection vulnerability exists in Online Student Enrollment System version 1.0, which can be exploited by an attacker to view, add, modify, or delete information in the back-en...

Electricity Consumption Monitoring Tool SQL注入漏洞

Electricity Consumption Monitoring Tool is an electricity consumption monitoring tool by rems individual developer. A SQL injection vulnerability exists in Electricity Consumption Monitoring Tool version 1.0, which originates from an unknown function in /endpoint/delete-bill.php that causes SQL...

CVE-2024-4264

The CVE-2024-4264 entry affects berriai/litellm. The vulnerability is caused by unsafe use of eval in litellm.get_secret() when the server uses Google KMS, allowing untrusted data to be evaluated. Attackers can inject malicious values into environment variables via the /config/update endpoint, en...