4044 matches found
CVE-2022-46122
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/viewcategory.php?id=...
Siemens SICAM PAS/PQS 代码问题漏洞
Siemens SICAM PAS/PQS is a software from Siemens with an operating system for energy automation and power quality. A security vulnerability exists in Siemens SICAM PAS/PQS versions prior to V7.0 that stems from a failure to properly protect the containing folder. An attacker can exploit the...
PT-2022-24569 · WordPress · The Car Dealer (Dealership)/Vehicle Sales Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: The Car Dealer Dealership and Vehicle sales WordPress Plugin versions prior to 3.05 Description: The issue is related to improper authorization and CSRF in an AJAX action. This allows any authenticated users, such as subscribers, to call the...
S-CMS 跨站脚本漏洞
S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A security vulnerability exists in S-CMS version 5.0 Build 20220328. An attacker can exploit the vulnerability to perform cross-site scripting attacks...
Akeneo PIM Development Repository 代码注入漏洞
Akeneo PIM Development Repository is an Akeneo open source repository . It is used to develop Akeneo PIM products. A code injection vulnerability exists in Akeneo PIM Development Repository versions prior to v5.0.119 and v6.0.53, which originates from a code injection vulnerability that could all...
PT-2022-36023 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.10 Description: The issue is related to a use-after-free in the snd soc exit function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...
pb-cms 安全漏洞
pb-cms is a content management system by LinZhaoguan Personal Developer. A security vulnerability exists in pb-cms version 2.0, which stems from its IpUtil.getIpAddr function that allows attackers to implement cross-site scripting. The attack method has been made public and can be initiated...
CVE-2022-3858
CVE-2022-3858 affects the WordPress plugin Chaty / Floating Chat Widget prior to version 3.0.3. The issue is an SQL injection caused by improper sanitisation/escaping of a parameter before it is used in a SQL statement, making it exploitable by users with a role as low as admin. Documented impact...
CVE-2022-43097
Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & login pages...
WordPress plugin Clerk 信息泄露漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...
CVE-2022-45328
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/editmembers.php...
CVE-2022-4033
The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'questionid' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value i.e. a number, file path,...
CVE-2022-42109
Online-shopping-system-advanced 1.0 was discovered to contain a SQL injection vulnerability via the p parameter at /shopping/product.php...
CVE-2022-44860
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/transactions/updatestatus.php...
CVE-2022-44858
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/products/viewproduct.php...
GHSA-JVC3-WJF6-7C6C Apache Dolphin Scheduler has insufficiently protected credentials
When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...
PT-2022-27525 · Unknown · Alarm Instance Management
Name of the Vulnerable Software and Affected Versions: Alarm instance management versions prior to 2.0.6 Description: The issue is related to command injection in alarm instance management when a specific command is configured, affecting only logged-in users. Recommendations: For versions prior t...
Parallels Remote Application Server 安全漏洞
Parallels Remote Application Server RAS is an application delivery and VDI Virtual Desktop Infrastructure solution from Parallels, Inc. in the United States. A security vulnerability exists in Parallels Remote Application Server version v18.0 that stems from the vulnerability of the web client to...
Insyde InsydeH2O 缓冲区错误漏洞
Insyde InsydeH2O is a C language source from Insyde Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Insyde A buffer overflow vulnerability exists in InsydeH2O 5.0 and later, 5.5 and earlier versions,...