Sql injection

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customersupport/managedepartment.php...

Sql injection

SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component...

Sql injection

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customersupport/ajax.php...

Sql injection

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customersupport/index.php?page=editcustomer...

Sql injection

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customersupport/ajax.php?action=login...

CVE-2023-43318

Summary: CVE-2023-43318 affects TP-Link JetStream Smart Switch TL-SG2210P (v5.0, Build 20211201). Affects the webconsole endpoints under usermanagement/swtmactablecfg, where privilege escalation is possible by modifying the GET parameters tid and usrlvl. The issue is described as Improper Access ...

CVE-2024-27764

Jeewms v3.7 and earlier are affected by a privilege-escalation issue through the AuthInterceptor component. Public documents consistently state remote attackers can escalate privileges, implying impact to confidentiality, integrity, and availability as per CVSS v3.1 metrics (CRITICAL, AV:N, AC:L,...

CVE-2022-46088

CVE-2022-46088 affects Online Flight Booking Management System v1.0. Multiple connected sources report a cross-site scripting (XSS) vulnerability via the feedback form, caused by improper handling of user-supplied input. The descriptions consistently identify the feedback form as the entry point ...

CVE-2023-48644

The CVE-2023-48644 entry affects Archibus app version 4.0.3 on iOS, with a cross-site scripting (XSS) vulnerability in the description field of the maintenance module’s Create Work Request feature. The underlying issue allows an attacker to perform actions on behalf of the user and exfiltrate dat...

CVE-2024-25817

Affected software: eza (before v0.18.2). Root cause / vulnerability: Buffer overflow allowing local attackers to execute arbitrary code through .git/HEAD, .git/refs, and .git/objects components.** Impact:** Local code execution with high impact as described in multiple advisories. References from...

CVE-2024-26335

CVE-2024-26335 affects swftools v0.9.2, with a segmentation violation in the state_free function (swftools/src/swfc-history.c), causing a Denial of Service in some reports. No patch details are provided in the documents; remediation information is not available. Notes from CNVD/CNNVD describe a D...

CVE-2024-27564

CVE-2024-27564 describes a Server-Side Request Forgery in pictureproxy.php (dirk1983 mm1.ltd, commit f9f4bbc). The flaw allows an attacker to supply a crafted URL via the url parameter to trigger arbitrary requests from the application, potentially reading local or internal resources. Connected d...

CVE-2024-25269

CVE-2024-25269 : Upstream reports show that libheif

CVE-2024-27765

CVE-2024-27765 affects Jeewms versions 3.7 and earlier. Affected component: the cgformTemplateController, with a directory traversal vulnerability that allows a remote attacker to obtain sensitive information. Root cause is a directory traversal issue in the controller. Documented impact indicate...

CVE-2024-27563

CVE-2024-27563 is an SSRF in WonderCMS v3.1.3, traced to the getFileFromRepo function. The flaw lets an attacker coerce the application to make arbitrary outbound requests by injecting crafted URLs into the pluginThemeUrl parameter. Affected software: WonderCMS 3.1.3 (PHP-based CMS). Root cause: ...

CVE-2024-26337

CVE-2024-26337 affects swftools, specifically version 0.9.2, where a segmentation violation is caused by the s_font function in swftools/src/swfc.c. The issue has limited public exploit detail in the provided sources, with several feeds (e.g., CNVD, NVD, Red Hat, Ubuntu OSV, Nessus) identifying a...

CVE-2024-22188

Summary of CVE-2024-22188 : TYPO3 before 13.0.1 allows an authenticated admin (system maintainer) to inject and execute arbitrary shell commands on the web server via a command injection vulnerability in the Install Tool’s form fields. This impacts TYPO3 core prior to 13.0.1 and is fixed in the f...

CVE-2024-24275

The CVE-2024-24275 issue affects Teamwire Windows desktop client versions 2.0.1–2.4.0. A Cross Site Scripting (XSS) vulnerability exists in the global search function that allows a remote attacker to obtain sensitive information via a crafted payload. The vulnerability is described across multipl...

CVE-2024-26333

CVE-2024-26333 affects swftools version 0.9.2. The issue is a segmentation violation in the function free_lines within swftools/lib/modules/swfshape.c, which can cause abnormal termination/crash. This is supported by multiple connected sources (e.g., PT-2024-21356 notes a memory-access issue in f...

CVE-2024-27622

CMS Made Simple v2.2.19/v2.2.21 contains a remote code execution (RCE) flaw in the User Defined Tags module. The vulnerability arises from inadequate sanitization of user-supplied input in the module’s Code section, allowing authenticated users with administrative privileges to inject and execute...