44 matches found
Design/Logic Flaw
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query...
CVE-2023-22665
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query...
CVE-2023-1940
A vulnerability classified as critical was found in SourceCodester Simple and Beautiful Shopping Cart System 1.0. This vulnerability affects unknown code of the file deleteuserquery.php. The manipulation of the argument userid leads to sql injection. The attack can be initiated remotely. The...
CVE-2023-1940 SourceCodester Simple and Beautiful Shopping Cart System delete_user_query.php sql injection
A vulnerability classified as critical was found in SourceCodester Simple and Beautiful Shopping Cart System 1.0. This vulnerability affects unknown code of the file deleteuserquery.php. The manipulation of the argument userid leads to sql injection. The attack can be initiated remotely. The...
PT-2023-17356 · Sourcecodester · Sourcecodester Simple/Beautiful Shopping Cart System
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple and Beautiful Shopping Cart System version 1.0 Description: A critical issue was found in the delete user query.php file, where the manipulation of the user id argument leads to SQL injection. The attack can be initiated...
Simple and Beautiful Shopping Cart System SQL注入漏洞
Simple and Beautiful Shopping Cart System is an e-commerce platform. A SQL injection vulnerability exists in SourceCodester Simple and Beautiful Shopping Cart System version 1.0, which stems from a problem in the file deleteuserquery.php, where manipulation of the parameter userid can lead to sql...
jeecg 安全漏洞
jeecg is a software application. An intelligent development platform based on a code generator. A security vulnerability exists in jeecg-boot version 2.4.5, which stems from an insecure permission setting. An attacker can exploit the vulnerability to gain escalated privileges and view sensitive...
Design/Logic Flaw
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...
GHSA-QF9Q-Q4HH-QPH3 SQL injection in blazer
Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run...
CVE-2022-29498
Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run...
Sql injection
Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run...
CVE-2022-29498
Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run...
CVE-2022-29498
Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run...
Jeecg-boot SQL Injection Vulnerability (CNVD-2022-22566)
Jeecg-Boot is a low-code platform based on the code generator from the JeecgBoot community. Jeecg-boot version v3.0 is vulnerable to SQL injection, which can be exploited by attackers to perform SQL injection via /jeecg-boot/sys/user/queryUserByDepId...
CVE-2022-22881
Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData...
CVE-2022-22880
Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId...
Better Notifications for WP < 1.8.7 - Email Address Disclosure
The plugin does not have authorisation and CSRF check in its bnfwsearchusers AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes finding the first letter, then the second one, then the third one etc.. PoC import sys import string import urllib.parse import...
CVE-2021-20326
A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4...
Denial of service
A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4...
CVE-2018-1058
CVE-2018-1058 affects PostgreSQL 9.3–10, where a flaw in search_path handling allowed a logged-in user to modify query behavior for other users and potentially execute code with the database superuser privileges. The related connected advisories confirm upstream remediation: PostgreSQL upstream f...