PT-2025-45364

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.12.6 Description SuiteCRM’s export functionality has a SQL injection issue due to a failure to sanitize SQL query structure when processing the uid parameter. Successful exploitation could allow a remote,...

showdoc uid Parameter SQL Injection Vulnerability

showdoc is open source a great tool for IT teams to share documents online. A SQL injection vulnerability exists in showdoc versions prior to 2.10.3, which stems from a lack of validation of the uid parameter of showdoc against externally entered SQL statements. An attacker can exploit this...

CVE-2021-42565

myfactory.FMS before 7.1-912 allows XSS via the UID parameter...

Design/Logic Flaw

myfactory.FMS before 7.1-912 allows XSS via the UID parameter...

CVE-2021-42565

myfactory.FMS before 7.1-912 allows XSS via the UID parameter...

CVE-2021-42565

Summary : CVE-2021-42565 affects myfactory FMS; versions up to 7.1-912 are vulnerable to Cross-Site Scripting via the UID parameter. The Nuclei/NVD entries corroborate the issue and describe it as a client-side script execution risk in login/UID handling. The connected documents specify the affec...

CVE-2021-42565: Improper Neutralization of Input During Web Page Generation

myfactory.FMS before 7.1-912 allows XSS via the UID parameter...

myfactory.FMS 跨站脚本漏洞

myfactory.FMS is a transaction management system. A cross-site scripting vulnerability exists in Myfactory.FMS that stems from the product's UID parameter failing to properly validate user input data. The vulnerability can be exploited to execute client-side code. The following products and...

U.S. Dept Of Defense: IDOR on https://██████ via POST UID enables database scraping

Summary: The UID parameter on █████████ in the ██████ ███████ system, with ███████, does not validate that the caller has permission to view information on the UID entered, thereby enabling personnel and student data extraction. Description: The user operations API endpoint for the ███ ██████████...

CVE-2011-4820

IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using the UID parameter to modify another user's preferences...

CVE-2011-4820: Undefined Security Weakness

IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using the UID parameter to modify another user's preferences...

SQL Injection Vulnerability in admin.php of Jinwei Mobile Mall System Version 0.2.4

Jinwei mobile mall system is a micro-business customers with a public number, imitation hand Tao page layout, support embedded video playback. Support customized model specifications, the main specifications support attached pictures, each subdivided model support inventory control, subdivided...

CVE-2019-14266

OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...

CVE-2019-14266

OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...

Sql injection

OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...

CVE-2019-14266

OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...

CVE-2019-14266

OpenSNS v6.1.0 is affected by an SQL injection in the index.php?s=/ucenter/Config/ uid parameter caused by the getNeedQueryData function in Application/Common/Model/UserModel.class.php. The issue enables manipulation of SQL queries via the uid parameter, as documented by multiple sources (e.g., C...

CVE-2018-13294

Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter...

CVE-2018-13294

Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter...

CVE-2018-13294: Exposure of Sensitive Information to an Unauthorized Actor

Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensitive system information via the uid parameter...