CVE-2024-44413

A vulnerability was discovered in DI8200-16.07.26A1, which has been classified as critical. This issue affects the upgradefilterasp function in the upgradefilter.asp file. Manipulation of the path parameter can lead to command injection...

CVE-2024-9532

A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The...

CVE-2024-47657

This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter dfclientid through API request URLs which could lead to unauthorized access to sensitive...

CVE-2024-47657

Shilpi Net Back Office is affected by CVE-2024-47657 due to improper access controls on API endpoints. An authenticated remote attacker could manipulate the dfclientid parameter in API request URLs to gain unauthorized access to other users’ sensitive information. Connected documents confirm this...

NetAdmin IAM 安全漏洞

NetAdmin IAM is an application from NetAdmin, Inc. A security vulnerability exists in NetAdmin IAM version 3.5 and prior versions, which stems from an improper manipulation of the parameter username can lead to information disclosure...

CVE-2024-47085 Parameter Manipulation Vulnerability

This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters cCdslClicentcode and cLdClientCode in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to...

CVE-2024-47085 Parameter Manipulation Vulnerability

This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters cCdslClicentcode and cLdClientCode in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to...

CVE-2024-25270

Mirapolis LMS 4.6.XX contains an IDOR vulnerability that authenticated users can exploit by manipulating the ID parameter and incrementing the STEP parameter, potentially exposing sensitive user data. Root cause: insecure direct object reference in the affected endpoint. Affected product/version:...

CVE-2024-45786

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to gain unauthorized access to sensitive...

CVE-2024-45787

CVE-2024-45787 affects Reedos aiM-Star ver. 2.0.1. The root cause is transmission of sensitive information in plaintext via specific API endpoints, enabling an authenticated remote attacker to manipulate a request URL parameter and intercept API responses, exposing other users’ data. The connecte...

ABCD2 跨站脚本漏洞

ABCD2 is an ABCD open source software suite for library and documentation center automation. A cross-site scripting vulnerability exists in ABCD2 2.2.0-beta-1 and earlier versions, which stems from some unknown handling of the file /buscarintegrada.php, where manipulation of the parameter...

Ruijie Networks EG2000K 代码问题漏洞

Ruijie Networks EG2000K is a multi-service security gateway from Ruijie Networks China. A code issue vulnerability exists in Ruijie Networks EG2000K version 11.16B2, which originates from the file /tool/index.php?c=download&a=save in unknown code, where manipulation of the parameter content can...

CVE-2024-8154

A vulnerability classified as problematic has been found in SourceCodester QR Code Bookmark System 1.0. Affected is an unknown function of the file /endpoint/update-bookmark.php of the component Parameter Handler. The manipulation of the argument tblbookmarkid/name/url leads to cross site...

SourceCodester Online Graduate Tracer System SQL注入漏洞

SourceCodester Online Graduate Tracer System is a web-based application project developed by SourceCodester using PHP and MySQL database. Its main purpose is to provide a platform for a school to track their alumni and generate graphical reports on alumni status. A SQL injection vulnerability...

SourceCodester Clinics Patient Management System SQL注入漏洞

SourceCodester Clinics Patient Management System is a clinic patient management system from SourceCodester, Inc. A SQL injection vulnerability exists in SourceCodester Clinics Patient Management System version 1.0, which stems from an incorrect manipulation of the parameter username that can lead...

Wanglong LTcms 代码问题漏洞

Wanglong LTcms is an enterprise website builder from China's Wanglong company. A code issue vulnerability exists in Wanglong LTcms version 1.0.20, which stems from an incorrect manipulation of the parameter url that can lead to server-side request forgery...

CVE-2024-21879

Enphase IQ Gateway (Envoy) is affected by CVE-2024-21879, a Command Injection vulnerability exploitable via a URL parameter on an authenticated endpoint. Affected versions are 4.x through 8.x and any version before 8.2.4225. The root cause is improper neutralization of special elements in the URL...

CVE-2024-21879 URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway formerly known as Envoy allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and 8.2.4225...

CVE-2024-21880 URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway formerly known as Enphase allows OS Command Injection.This issue affects Envoy: 4.x = 7.x...

itsourcecode Airline Reservation System 安全漏洞

itsourcecode Airline Reservation System is an airline reservation system from itsourcecode, Inc. A security vulnerability exists in version 1.0 of itsourcecode Airline Reservation System, which stems from an incorrect manipulation of the parameter page can lead to file inclusion...