3322 matches found
CVE-2024-5709
The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layoutname' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an...
PT-2024-38394 · Unknown · Bike Delivery System
Name of the Vulnerable Software and Affected Versions: Bike Delivery System version 1.0 Description: A critical issue was found in the Bike Delivery System, affecting an unknown function of the file contact us action.php. The manipulation of the name argument leads to SQL injection. It is possibl...
SourceCodester Tracking Monitoring Management System 跨站脚本漏洞
SourceCodester Tracking Monitoring Management System is a monitoring management system from SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Tracking Monitoring Management System version 1.0, which is caused by a cross-site scripting vulnerability in the name...
CVE-2024-41630
Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10EN allows a remote attacker to execute arbitrary code via the ssid parameter at ip/goform/fastsettingwifiset...
CVE-2024-7218
A flaw has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected is an unknown function of the file /admin/ajax.php?action=savestudent. Executing manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit ha...
CVE-2024-7214
A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. The attack can be launched remotely. T...
CVE-2024-7213
A vulnerability, which was classified as critical, was found in TOTOLINK A7000R 9.1.0u.6268B20220504. Affected is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to buffer overflow. It is possible to launch the attack remotely. The exploit h...
PT-2024-38178
Name of the Vulnerable Software and Affected Versions: SourceCodester School Log Management System version 1.0 Description: A problem was found in the processing of the file "/admin/ajax.php?action=save student". The manipulation of the name argument leads to cross-site scripting. The attack can ...
TOTOLINK A3700R Command Injection Vulnerability
TOTOLINK A3700R is a wireless router, launched by TOTOLINK China Gion Electronics, a Taiwan-based networking equipment manufacturer. The TOTOLINK A3700R suffers from a command injection vulnerability located in the /cgi-bin/cstecgi.cgi file, which stems from improper handling of the hostName...
TOTOLINK A3700R 命令注入漏洞
TOTOLINK A3700R is a wireless router, launched by TOTOLINK China Gion Electronics, a Taiwan-based networking equipment manufacturer. The TOTOLINK A3700R suffers from a command injection vulnerability located in the /cgi-bin/cstecgi.cgi file, which stems from improper handling of the hostName...
PT-2024-37848 · WordPress · Social Auto Poster
Name of the Vulnerable Software and Affected Versions: Social Auto Poster plugin for WordPress versions up to, and including, 5.3.14 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the wp name parameter of the wpw auto...
CVE-2024-40051
IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter...
PT-2024-28768 · Ip Guard · Ip Guard
Name of the Vulnerable Software and Affected Versions: IP Guard version 4.81.0307.0 Description: The issue allows for an arbitrary file read via the file name parameter. Recommendations: For IP Guard version 4.81.0307.0, consider restricting access to the file name parameter to minimize the risk ...
CVE-2024-40051
IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter...
CVE-2024-40392
SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injection vulnerability via the name parameter under addnew.php...
CVE-2024-40456
ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php...
CVE-2024-40392
SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injection vulnerability via the name parameter under addnew.php...
CVE-2024-40456
ThinkSAAS v3.7.0 contains an SQL injection vulnerability exploitable via the name parameter in /system/action/update.php. Root cause described in connected sources as insufficient validation of external input in that endpoint. CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no pri...
ThinkSAAS 安全漏洞
ThinkSAAS is ThinkSAAS open source a code completely open source , flexible and open building system program . ThinkSAAS version 3.7.0 SQL injection vulnerability exists , the vulnerability stems from the name parameter in the systemactionupdate.php lack of validation of external input SQL...