PT-2024-16287 · Unknown · Project Worlds Online Time Table Generator

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Time Table Generator version 1.0 Description: A critical issue has been found in the software, affecting an unknown function of the file /timetable/admin/admindashboard.php?info=add course. The manipulation of the argume...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

PT-2024-7998 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename table function. This is due to the lack of measures to neutraliz...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the app\curd\controller\Table.php file. An attacker can manipulate SQL queries and access or alter database information without proper authorization. Remediation There is no fixed version for funadmin/funadmin...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the edit method in controller\Table.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issue...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through list method in curd\controller\Table.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issu...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the getSystemTable and Delete methods in the common.php file. An attacker can disrupt service availability by exploiting this logic flaw to delete critical commands. Details Denial of Service DoS describes a...

GHSA-9GW3-QR2F-3VG5 SQL injection in funadmin

Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield...

SQL injection in funadmin

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...

SQL injection in funadmin

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...

SQL injection in funadmin

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...

SQL injection in funadmin

Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield...

CVE-2024-48226

Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield...

CVE-2024-48218

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...

CVE-2024-48222

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...

CVE-2024-48223

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...

FunAdmin 安全漏洞

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an SQL injection vulnerability in /curd/table/list...

CVE-2024-48223

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...

CVE-2024-48226

Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield...

CVE-2024-48222

Summary: CVE-2024-48222 affects Funadmin v5.0.2 with a SQL injection in the /curd/table/edit endpoint. The vulnerability stems from insufficient input validation, allowing untrusted data to be used directly in SQL queries. Connected sources corroborate a SQL injection risk and indicate potential ...