61 matches found
Landray EKP - Path Traversal
A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sysuicomponent/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to...
CVE-2024-58352
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input...
CVE-2024-58352 Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input...
CVE-2024-58352 Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input...
CVE-2024-58352
Landray OA is affected by an unauthenticated HQL injection through the wechatLoginHelper.do endpoint’s uid parameter. The vulnerability stems from a string-concatenated filter expression passed to Hibernate findList(), enabling attackers to query arbitrary Hibernate entity classes and extract sen...
CVE-2024-58352
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input...
EUVD-2024-55647
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input...
PT-2026-55264
Name of the Vulnerable Software and Affected Versions Landray OA affected versions not specified Description An unauthenticated HQL injection exists, allowing attackers to query arbitrary Hibernate entity classes. This occurs due to insufficient input sanitization in the string-concatenated filte...
VulnCheck KEV: CVE-2024-58352
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input...
CVE-2024-58352: SQL Injection: Hibernate
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input...
Landray EIS SQL注入漏洞
Landray EIS 2001 through 2006 contains a SQL injection caused by unsanitized input in Message/fimessagereceiver.aspx?replyid=, letting attackers execute arbitrary SQL commands, exploit requires crafted input. id: CVE-2025-22214 info: name: Landray EIS SQL注入漏洞 author: Ark severity: critical...
VulnCheck KEV: CVE-2025-22214
Landray EIS 2001 through 2006 allows Message/fimessagereceiver.aspx?replyid= SQL injection...
EUVD-2021-26503
Malware in sbrugna...
EUVD-2024-33695
Malicious code in bioql PyPI...
EUVD-2024-33696
Malicious code in bioql PyPI...
EUVD-2025-2670
Malicious code in bioql PyPI...
Landray OA EKP 安全漏洞
Landray OA EKP Landray EKP is an office collaboration software from China Landray company. A security vulnerability exists in Landray OA EKP v16, which originates from an arbitrary download vulnerability in the /ui/sysuiextend/sysUiExtend.do component, which may result in obtaining the backend...
CVE-2025-22214
Landray EIS 2001 through 2006 allows Message/fimessagereceiver.aspx?replyid= SQL injection...
CVE-2024-11239
A vulnerability has been found in Landray EKP up to 16.0 and classified as critical. This vulnerability affects the function deleteFile of the file /sys/common/import.do?method=deleteFile of the component API Interface. The manipulation of the argument folder leads to path traversal. The attack c...
CVE-2024-11238
A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sysuicomponent/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to...