CVE-2022-45786

CVE-2022-45786 documents a SQL injection in Apache AGE when using the Golang and Python drivers with PostgreSQL 11/12 (up to AGE 1.1.0). Root cause: the cypher() placeholder could not be parameterized, and driver parameterization was insufficient, enabling injections. Mitigation: upgrade the Gola...

CVE-2022-45786 Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection

There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition t...

Apache AGE SQL注入漏洞

Apache AGE is a PostgreSQL extension from the Apache Foundation that provides graphical database functionality. An SQL injection vulnerability exists in the Apache AGE driver, which stems from an inability to parameterize passed values, leading to SQL injection...

PT-2023-14753

Name of the Vulnerable Software and Affected Versions AGE for PostgreSQL 11 versions up-to-and-including 1.1.0 AGE for PostgreSQL 12 versions up-to-and-including 1.1.0 Description There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. The problem is due t...

Upgraded Q -> M from #451 [1668467945427]

Judge has assessed an item in Issue 451 as M risk. The relevant finding follows: THRESHOLD LIMIT CHECKS Certain parameters of the contracts can be configured to invalid values, causing a variety of issues and breaking expected interactions between contracts. setFlashLoanFee allows the owner of...

Sql injection

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the /rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive...

Sql injection

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive informati...

PT-2022-13920 · WordPress · Rsvpmaker

Name of the Vulnerable Software and Affected Versions: RSVPMaker plugin for WordPress versions up to and including 9.2.6 Description: The issue is related to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user-supplied data passed to a SQL query in the...

i3 International Annexxus Cameras 安全漏洞

i3 International Annexxus Cameras is a camera from the Canadian company i3 International. A security vulnerability exists in i3 International Annexxus Cameras Ax-n 5.2.0, which can be exploited to add a second administrative account by using the PUT and DELETE parameterizations, as well as by...

CVE-2022-0651

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpagetype parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...

Sql injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpageid parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...

Sql injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpagetype parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...

CVE-2021-4134

CVE-2021-4134 relates to the Fancy Product Designer WordPress plugin. The vulnerability is a SQL injection caused by insufficient escaping/parameterization of the ID parameter in the file ~/inc/api/class-view.php, affecting versions up to and including 4.7.4. The issue is exploitable by attackers...

WP Statistics < 13.1.6 - Unauthenticated Blind SQL Injection via current_page_type

The is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpagetype parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information...

CVE-2020-11496

Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. This firmware lacks the validation of the input values on the device side, which is provided by the engineering software during parameterization. Attackers with access ...

HP Virtual Table Server Detection

An HP Virtual Table Server VTS is listening on the remote host. VTS offers an alternative to standard parameterization for load and performance testing, and it is a component of HP LoadRunner and HP Performance Center. C Tenable Network Security, Inc. include"compat.inc"; if description...

逐浪CMS2个文件两个注入5处问题代码 另附其他注入绕过方式

简要描述： 厂商目前在安全方面已经下狠功夫了，虽然很多都参数化了以及数据类型的转换 但是难免会有遗漏，还望继续努力 详细说明： 注入点一 ： 文件 User/UserZone/StructView.aspx 参数：ID 后台代码片段： None 漏洞证明： 注入一 注入二...

Joomla! 'jform'参数HTML注入漏洞

Bugtraq ID:65932 Joomla!是一套在国外相当知名的内容管理系统。 Joomla!不正确过滤'jform'参数的数据，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Joomla! 3.2.2 目前没有详细解决方案提供： http://www.joomla.org ---request--- POST /k/cms/joomla/index.php/single-contact HTTP/1.1 Host: 10.149.14.62 ... Content-Length: 288...

Hastymail rs parameter command injection

Added: 12/28/2011 CVE: CVE-2011-4542 BID: 50791 OSVDB: 77331 Background Hastymail is a fast, secure, rfc-compliant, cross-platform IMAP/SMTP client application written in PHP providing a clean web interface for sending and reading E-mail. Problem Hastymail2 fails to properly sanitize user-supplie...