CVE-2023-44164

The 'Email' parameter of the processlogin.php resource does not validate the characters received and they are sent unfiltered to the database...

PT-2023-29134 · Online Movie Ticket Booking System +1 · Online Movie Ticket Booking System

Name of the Vulnerable Software and Affected Versions: process login.php affected versions not specified Description: The issue is related to the 'Email' parameter of the process login.php resource, which does not validate the characters received, sending them unfiltered to the database...

Projectworlds Online Movie Ticket Booking System SQL Injection Vulnerability

Projectworlds Online Movie Ticket Booking System is an online movie ticket booking system from Projectworlds India. Projectworlds Online Movie Ticket Booking System v1.0 suffers from a SQL injection vulnerability that originates from characters that are not validated as received and are sent to t...

Projectworlds Online Movie Ticket Booking System SQL Injection Vulnerability

Projectworlds Online Movie Ticket Booking System is an online movie ticket booking system from Projectworlds India. A SQL injection vulnerability exists in Online Movie Ticket Booking System v1.0, which originates from characters that are not validated as received and are sent to the database...

PT-2023-9454 · Mongodb · Mongodb Compass

Name of the Vulnerable Software and Affected Versions: MongoDB Compass versions 1.35.0 through 1.42.0 Description: The issue is related to the acceptance and use of insufficiently validated input from an untrusted external source by MongoDB Compass. This may cause unintended application behavior,...

CVE-2023-40581

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

Remote code execution

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

CVE-2023-40581 yt-dlp command injection when using `%q` in `--exec` on Windows

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

CVE-2023-40581

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

Remote code execution

The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in...

WordPress plugin wpDataTables code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2023-5425 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.25 Description: An authenticated SQL injection issue allows authenticated users to perform privilege escalation and remote code execution. The issue resides in the reports user.php file, specifically in the ajax ge...

Tenda AC23 get_parentControl_list_Info function heap buffer overflow vulnerability

Tenda AC23 is a home dual-band wireless router launched by Tenda, focusing on large home coverage and high-speed transmission, supporting 802.11acWave2 technology, dual-band concurrent rate up to 2033Mbps. Tenda AC23 suffers from a heap buffer overflow vulnerability, which stems from the...

Tenda AC23 缓冲区错误漏洞

Tenda AC23 is a home dual-band wireless router launched by Tenda, focusing on large home coverage and high-speed transmission, supporting 802.11acWave2 technology, dual-band concurrent rate up to 2033Mbps. Tenda AC23 suffers from a heap buffer overflow vulnerability, which stems from the...

PT-2023-4920 · D Link · D-Link Dap-2622

Name of the Vulnerable Software and Affected Versions: D-Link DAP-2622 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. The specific flaw exists within the DDP service, resulti...

ScienceLogic SL1 SQL注入漏洞

ScienceLogic SL1 is an application from ScienceLogic, Inc. Connect your real estate together to automate multidirectional data flow and workflow. A SQL injection vulnerability exists in ScienceLogic SL1 11.1.2 and earlier versions, which stems from a lack of validation of externally entered SQL...

ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)

Exploit Title: ReyeeOS 1.204.1614 - MITM Remote Code Execution RCE Google Dork: None Date: July 31, 2023 Exploit Author: Riyan Firmansyah of Seclab Vendor Homepage: https://ruijienetworks.com Software Link: https://www.ruijienetworks.com/support/documents/slideEW1200G-PRO-Firmware-B11P204 Version...

PT-2023-26300 · Kofax · Kofax Power Pdf

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a maliciou...

ChatEngine SQL Injection Vulnerability

ChatEngine is a Java web application . A SQL injection vulnerability exists in ChatEngine v1.0, which originates from the textMessage parameter of /src/chatbotapp/chatWindow.java that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute...

PT-2023-8305 · D Link · D-Link Dir-X3260

Name of the Vulnerable Software and Affected Versions: D-Link DIR-X3260 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this issue. The...