CVE-2021-39040

IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or sizes. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID:...

CVE-2022-0656

The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udrawconverturltobase64 AJAX action available to both unauthenticated and authenticated users before using it in the filegetcontents function and returning its content base64 encoded in the...

WordPress plugin Cab fare calcula 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A file inclusion vulnerability exists in versions of the WordPress plugin Cab fare calculator prior to...

WordPress plugin Videos sync PDF路径遍历漏洞

WordPress is a set of blogging platform developed using the PHP language. WordPress plugin Videos sync PDF version 1.7.4 and before there is a file inclusion vulnerability, the vulnerability stems from the plugin in the inclusion statement using the p parameter before failing to validate, an...

Attendance and Payroll System SQL注入漏洞

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system from oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component adminemployee edit.php lacks validation of external input...

Attendance and Payroll System SQL注入漏洞

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system by oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component adminovertime edit.php lacks validation of external input S...

Attendance and Payroll System SQL注入漏洞

Attendance and Payroll System is an attendance and payroll system using PHP/MySQLi source code from oretnom23 individual developers.Attendance and Payroll System v1.0 is vulnerable to SQL injection, which originates from the component adminattendanceedit.php lacks validation for external input SQ...

Attendance and Payroll System SQL注入漏洞

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system by oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component admincashadvancedelete.php lacks validation for external...

Sourcecodester Baby Care System SQL注入漏洞

Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 contains a SQL injection vulnerability that originates in /admin/pagerole.php & action=display & value=1 & roleid= where the roleid parameter lacks validati...

CVE-2022-20778

A vulnerability in the authentication component of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. This vulnerability is due to insufficient validation of user-supplied input by the...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerability exists in versions prior to MISP 2.4.158, which...

CVE-2021-44506

An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. A lack of input validation in calls to doverify in srunix/doverify.c allows attackers to attempt to jump to a NULL pointer by corrupting a function pointer...

Wecul Nyron SQL注入漏洞

A SQL injection vulnerability exists in Wecul Nyron version 1.0, which stems from a lack of validation of externally entered SQL statements in thes1 parameter of Nyron/Library/Catalog/winlibsrch.aspx. validation of external input SQL statements. An attacker could use this vulnerability to execute...

PT-2022-18415 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS version 1.11.13 Description: The issue is related to a lack of validation on the user modification form, which allows attackers to escalate privileges to Platform Admin. Recommendations: For Chamilo LMS version 1.11.13, update to ...

CVE-2022-26334

This CVE (CVE-2022-26334) is a buffer copy without checking size in Siemens SCALANCE X-300/XR324 family devices, triggered by unauthenticated HTTP GET requests that fail to validate the XNo parameter, leading to a device crash. Affected products include numerous SCALANCE X switch models (X302-7, ...

CSZ CMS SQL注入漏洞

CSZ CMS is a PHP-based open source content management system CMS. cszcmsadminMembersviewUsers version 1.2.2 contains a SQL injection vulnerability, which originates from the lack of validation of externally entered SQL statements and can be exploited by attackers to execute illegal SQL commands t...

Atom.CMS SQL注入漏洞

CMS is a content management system from The Digital Craft personal developer in the U.S. A SQL injection vulnerability exists in Atom.CMS version 2.0, which stems from a lack of validation of external input SQL statements in Atom.CMSadminajaxblur-save.php, which could be exploited by attackers to...

Atom.CMS SQL注入漏洞

CMS is a content management system from The Digital Craft individual developers in the U.S. A SQL injection vulnerability exists in Atom.CMS version 2.0, which stems from a lack of validation of external input SQL statements in Atom.CMSadminajaxpages.php, and could be exploited by attackers to...

Atom.CMS SQL注入漏洞

CMS is a content management system from The Digital Craft individual developers in the U.S. A SQL injection vulnerability exists in Atom.CMS version 2.0, which stems from a lack of validation of external input SQL statements in Atom.CMSadminajaxlist-sort.php, which could be exploited by attackers...

Atom.Cms SQL注入漏洞

CMS is a content management system from The Digital Craft personal developer in the U.S. A SQL injection vulnerability exists in Atom.CMS version 2.0, which stems from a lack of validation of external input SQL statements in Atom.CMSadminajaxnavigation.php, which could be exploited by attackers t...