814 matches found
CVE-2022-36161
Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter...
CVE-2022-36161
Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter...
CVE-2022-36161
Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter...
Sql injection
Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter...
CVE-2022-36161
CVE-2022-36161 affects Orange Station 1.0, with a SQL injection vulnerability exploitable via the username parameter. Root cause: improper handling of user input in the login/authentication flow leading to SQL injection. Potential impact: unauthorized access and data disclosure if exploited (as d...
CVE-2022-36161
Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter...
Orange Station SQL注入漏洞
Orange Station is a garage management system by Mayuri K. Personal developer. It helps users to manage all vehicles, cars and motorcycles. Orange Station version 1.0 suffers from a SQL injection vulnerability that stems from a security issue with the username parameter, which can be exploited by ...
PT-2022-23239 · Unknown · Orange Station
Name of the Vulnerable Software and Affected Versions: Orange Station version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the username parameter. Recommendations: For Orange Station version 1.0, update to a version that includes ...
MAL-2022-3835 Malicious code in ing-orange-login-sca-es (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ead5ed601ba0e5ae4f1c0bb3896d3e65abf85e1407cbed94361b44a0e676793 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WSO Arbitrary File Upload / Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WSO2 Arbitrary File Upload to RCE', 'Description' = %q This module abuses a vulnerability in certain WSO2 products that allow unrestricted file...
Exploit for Path Traversal in Wso2 Api_Manager
CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit. Details C...
Wordpress Orange Form Plugin Cross-Site Request Forgery Vulnerability
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. cross-site request forgery vulnerability exists in Wordpress Orange Form Plugin 1.0.1 and prior versions,...
WordPress Orange Form Plugin SQL Injection Vulnerability
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. A SQL injection vulnerability exists in the Wordpress Orange Form Plugin 1.0 and earlier versions, which originates in the product admin/orange-form-email.php file in the processbulkaction functi...
CVE-2021-24688
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing...
CVE-2021-24688
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing...
CVE-2021-24688
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing...
CVE-2021-24704
In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...
Cross site request forgery (csrf)
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing...
CVE-2021-24704 Orange Form <= 1.0 - SQL Injection via CSRF
In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...