CVE-2023-34732

An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force attacks to discover user passwords...

Exploit for Cross-site Scripting in Jquery

SQL Injection Vulnerability in Advaya GEMS ERP Portal v2.1 ⚠️...

CVE-2024-12580 Logs Debug Injection in danny-avila/librechat

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and fileid in the /code/download/:sessionId/:fileId and /download/:userId/:fileid APIs are not validated or filtered, leading to potential log injection...

CVE-2024-33818

Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference IDOR via the userID parameter...

CVE-2024-11127

A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploi...

PT-2024-16774 · Unknown · Lingdang Crm

Name of the Vulnerable Software and Affected Versions: Lingdang CRM versions up to 8.6.4.3 Description: A critical issue was found in the software, affecting an unknown functionality of the file /crm/WeiXinApp/marketing/index.php?module=Users&action=getActionList. The manipulation of the userid...

Lingdang CRM SQL注入漏洞

Lingdang CRM Lingdang CRM is a customer relationship management system from China Lingdang Lingdang company. A SQL injection vulnerability exists in Lingdang CRM 8.6.4.3 and earlier versions, which originates from the parameter userid in the file...

PT-2024-16779 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A critical issue has been found in the code-projects Job Recruitment software. The problem affects an unknown functionality of the file admin.php. The manipulation of the userid argument...

CVE-2024-10927

A vulnerability was found in MonoCMS up to 20240528. It has been classified as problematic. Affected is an unknown function of the file /monofiles/account.php of the component Account Information Page. The manipulation of the argument userid leads to cross site scripting. It is possible to launch...

MonoCMS 注入漏洞

MonoCMS is a content management system from MonoCMS, Inc. An injection vulnerability exists in MonoCMS 20240528 and prior versions, which stems from a cross-site scripting attack due to improper handling of the parameter userid...

CVE-2024-9613

The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress plugin FormFacade 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-11553 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...

CVE-2024-33818

Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference IDOR via the userID parameter...

CVE-2024-33818

Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference IDOR via the userID parameter...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...

PT-2024-24185 · Unknown · Kliqqi-Cms

Name of the Vulnerable Software and Affected Versions: Kliqqi-CMS version 2.0.2 Description: The issue is related to SQL Injection in the load data.php file via the userid parameter. This allows for potential exploitation. Recommendations: For Kliqqi-CMS version 2.0.2, consider restricting access...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data.php via the userid parameter. Reported as CVE-2024-31673; CVSS 3.1 base score 9.8 (Network, Privileges NONE, User Interaction NONE; Confidentiality/Integrity/Availability: HIGH). Root cause: improper handling of the userid input enablin...