233 matches found
CVE-2021-42565
Summary : CVE-2021-42565 affects myfactory FMS; versions up to 7.1-912 are vulnerable to Cross-Site Scripting via the UID parameter. The Nuclei/NVD entries corroborate the issue and describe it as a client-side script execution risk in login/UID handling. The connected documents specify the affec...
CVE-2021-42565
myfactory.FMS before 7.1-912 allows XSS via the UID parameter...
myfactory.FMS 跨站脚本漏洞
myfactory.FMS is a transaction management system. A cross-site scripting vulnerability exists in Myfactory.FMS that stems from the product's UID parameter failing to properly validate user input data. The vulnerability can be exploited to execute client-side code. The following products and...
U.S. Dept Of Defense: IDOR on https://██████ via POST UID enables database scraping
Summary: The UID parameter on █████████ in the ██████ ███████ system, with ███████, does not validate that the caller has permission to view information on the UID entered, thereby enabling personnel and student data extraction. Description: The user operations API endpoint for the ███ ██████████...
CVE-2011-4820
IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using the UID parameter to modify another user's preferences...
SQL Injection Vulnerability in admin.php of Jinwei Mobile Mall System Version 0.2.4
Jinwei mobile mall system is a micro-business customers with a public number, imitation hand Tao page layout, support embedded video playback. Support customized model specifications, the main specifications support attached pictures, each subdivided model support inventory control, subdivided...
CVE-2019-14266
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...
CVE-2019-14266
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...
Sql injection
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...
CVE-2019-14266
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...
CVE-2019-14266
OpenSNS v6.1.0 is affected by an SQL injection in the index.php?s=/ucenter/Config/ uid parameter caused by the getNeedQueryData function in Application/Common/Model/UserModel.class.php. The issue enables manipulation of SQL queries via the uid parameter, as documented by multiple sources (e.g., C...
CVE-2018-13294
Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter...
CVE-2018-13294
Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter...
Sql injection
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...
CVE-2018-18084
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...
CVE-2018-18084
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...
CVE-2018-18084
CVE-2018-18084 affects DuomiCMS 3.0. A SQL injection exists in the ajax.php file, demonstrated by the uid parameter. The issue is rated with CVSS v3.1: base score 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack needs no authentication or user interac...
CVE-2018-18084
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...
Dicoogle PACS 2.5.0 - Directory Traversal
Dicoogle PACS 2.5.0 - Directory Traversal Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal Date: 2018-05-25 Software Link: http://www.dicoogle.com/home Version: Dicoogle PACS 2.5.0-201712291522 Category: webapps Tested on: Windows 2012 R2 Exploit Author: Carlos Avila Contact:...