Open Source SACCO Management System SQL注入漏洞

Open Source SACCO Management System is an open source SACCO management system by Mayuri K. Individual developer. An SQL injection vulnerability exists in Open Source SACCO Management System v1.0, which originates from a security issue with the id parameter of /saccoshield/ajax.php?action=deletelo...

fake flash loan can grief the pool

Lines of code Vulnerability details there is a scenario where an attacker/griefer can use flash function and trick the pool to think he has paid the flash and the fee while he was only paying back the flash. about double/multiple erc20 tokens : some erc20 tokens have multiple entry points . those...

The price be manipulated when the liquidity is thin because the flashloan feature and swap feature are present at the same time in algebra pool

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. the price curve pool in the application is xy = k with price range and centralized liqudiity, when the liquidity is thin, the price can be easily manipulated at the favor of malicious user because the...

Users can regain gobblers they use to mint Legendary Gobbler with.

Lines of code Vulnerability details Impact Users can mint legendary gobblers without actually burning their gobblers by using the GobblersERC721.approve function to approve themselves before minting their legendary gobbler the burn mechanism, doesn't delete the getApproved approved entry for that...

Threat Source newsletter (Sept. 22, 2022) — Attackers are already using student loan relief for scams

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. We’ve seen attackers capitalize on the news time and again, from COVID-19 to U.S.-North Korea relationships and, of course, holiday shopping sales every November. So, I was far from surprised to see that attackers are...

CVE-2022-37139

Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability...

CVE-2022-37138

Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form...

CVE-2022-37138

Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form...

CVE-2022-37139

Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability...

CVE-2022-37139

Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability...

Cross site scripting

Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability...

CVE-2022-37138

CVE-2022-37138 affects Loan Management System 1.0 and is caused by SQL Injection on the login page, enabling unauthorized users to log in as Administrator via the username field. Documented impact indicates high consequences (C: High, I: High, A: High) with CVSSv3.1/3.1 base score 9.8 (AV:N/AC:L/...

CVE-2022-37139

CVE-2022-37139 is reported against the Loan Management System version 1.0 and is described in connected sources as a persistent cross-site scripting (XSS) vulnerability. Public documents do not provide concrete fixes, patches, or affected build details beyond the generic vulnerability description...

CVE-2022-37139

Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability...

PT-2022-23833 · Unknown · Alton Management System

Name of the Vulnerable Software and Affected Versions: Loan Management System version 1.0 Description: The Loan Management System has a persistent cross-site scripting issue. This means that an attacker can inject malicious scripts into the system, which will be executed by other users' browsers,...

Loan Management System SQL注入漏洞

Loan Management System is a loan management system by razormist individual developers. A SQL injection vulnerability exists in Loan Management System version 1.0, which originates from allowing an unauthorized user to log in as an administrator after injecting a username form...

PT-2022-23832 · Unknown · Alton Management System

Name of the Vulnerable Software and Affected Versions: Loan Management System version 1.0 Description: The issue allows unauthorized users to login as Administrator after injecting the username form at the login page, specifically through SQL Injection. Recommendations: For Loan Management System...

Loan Management System 跨站脚本漏洞

Loan Management System is a loan management system by razormist Personal Developer. A security vulnerability exists in Loan Management System version 1.0, which can be exploited by attackers to perform cross-site scripting attacks...

an attacker can take out flash loan and cause users not to be able to redeem their tokens because of undflow or divsion by zero

Lines of code Vulnerability details Impact An attacker can take out a flash loan and cause the state variable redeemBase=1 causing users who call this function to get dosed and since users can't call this function after the attacker makes the reedem function unuseable which can cause funds to be...

Non-standard/Malicious token transfers may cause loans not to be paid.

Lines of code Vulnerability details Impact Non-standard token transfers may cause loans not to be paid. Proof of Concept The TRSRY.sol has repayLoan function for the users to repay their loan as per the ERC20 token. The function is as below; function repayLoanERC20 token, uint256 amount external...