1517 matches found
Sql injection
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
Sql injection
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
PT-2022-25848
Name of the Vulnerable Software and Affected Versions Online Pet Shop We App version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/?page=orders/view order" API endpoint. Recommendations For Online Pet...
Online Pet Shop We App SQL注入漏洞
Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A security vulnerability exists in version 1.0 of Online Pet Shop We App, which stems from an SQL injection issue in the id parameter of the /admin/?page=orders/vieworder location...
CVE-2022-41408
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
Online Pet Shop We App SQL注入漏洞
Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A security vulnerability exists in version 1.0 of Online Pet Shop We App, which stems from an SQL injection issue in the id parameter of the /admin/?page=orders/vieworder location...
CVE-2022-41407
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
CVE-2022-41408: Improper Neutralization of Special Elements used in an SQL Command
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
CVE-2022-41407: Improper Neutralization of Special Elements used in an SQL Command
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
blockRange should have a minimal value
Lines of code Vulnerability details Impact The blockRange doesn't have any minimal value so owner can call the setBlockRange function to change the blockRange value to a lower value which will automaticaly block the matching of some of the orders that have expirationTime == 0. Proof of Concept Th...
execute does not work for ERC1155 tokens orders where amount > 1
Lines of code Vulnerability details Impact StandardPolicyERC1155 functions canMatchMakerBid and canMatchMakerBid always return amount == 1, regardless of the function arguments. This means that calling execute on an agreed order of ERC1155 token with an amount 1 will always transfer amount == 1 o...
Asset that seller or buyer does not intend to sell or buy can be unexpectedly sold or bought
Lines of code Vulnerability details Impact Calling the execute function further calls the validateSignatures function, which executes if order.order.trader == msg.sender return true; . This means that the user, who calls the execute function, does not need to verify that the corresponding order w...
onlineorders.org.uk Cross Site Scripting vulnerability OBB-2981048
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-45788
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...
CVE-2021-45788
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...
Sql injection
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...
Zammad 安全漏洞
Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.1, which stems from a fine-grained permission model that allows configuring read-only access to work orders, however, agents are still able to incorrectly perform...
Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to change work orders that the user should not have access to change (CVE-2015-7395)
Summary IBM Maximo Asset Management contains a vulnerability which could allow an authenticated user to change work orders that the user should not have access to change due to improper access control. This vulnerability could allow a local attacker to compromise data integrity. The vulnerability...
WordPress plugin WooCommerce 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...