CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...

CVE-2023-39852

Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party who claims that the userid is a session variable controlled by the server, and thus cannot be used for exploitation. The original reporter...

CVE-2023-43270

dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...

CVE-2023-36100

An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser...

CVE-2023-34755

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user=edit...

CVE-2023-1557

A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to...

CVE-2022-25228

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings=show' via the 'userID' parameter, in '/index.php?m=candidates=show' via the 'candidateID', in '/index.php?m=joborders=show' via the 'jobOrderID' and '/index.php?m=companies=show' via the...

CVE-2022-43232

Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /phpaction/fetchOrderData.php...

CVE-2022-43233

Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /phpaction/fetchSelectedUser.php...

CVE-2010-2508

SQL injection vulnerability in user-profile.php in 2daybiz Video Community Portal Script allows remote attackers to execute arbitrary SQL commands via the userid parameter...

CVE-2013-3600

Coursemill Learning Management System LMS 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions...

CVE-2025-4863

Summary: CVE-2025-4863 affects Advaya Softech GEMS ERP Portal 2.1, targeting the /studentLogin/studentLogin.action endpoint. The vulnerability arises from manipulation of the userId parameter, enabling SQL injection and remote initiation. Public disclosures and PoC materials exist (e.g., GEMS_POC...

CVE-2025-4863 Advaya Softech GEMS ERP Portal studentLogin.action sql injection

A vulnerability, which was classified as critical, was found in Advaya Softech GEMS ERP Portal 2.1. This affects an unknown part of the file /studentLogin/studentLogin.action. The manipulation of the argument userId leads to sql injection. It is possible to initiate the attack remotely. The explo...

CVE-2025-4863 Advaya Softech GEMS ERP Portal studentLogin.action sql injection

A vulnerability, which was classified as critical, was found in Advaya Softech GEMS ERP Portal 2.1. This affects an unknown part of the file /studentLogin/studentLogin.action. The manipulation of the argument userId leads to sql injection. It is possible to initiate the attack remotely. The explo...

Advaya Softech GEMS ERP Portal 注入漏洞

Advaya Softech GEMS ERP Portal is an enterprise resource planning ERP portal system from Advaya Softech India that provides enterprise-level business process management, financial management, and supply chain integration capabilities. An injection vulnerability exists in Advaya Softech GEMS ERP...

CVE-2023-34732

An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force attacks to discover user passwords...

Flytxt NEON-dX 安全漏洞

Flytxt NEON-dX is an enterprise software product from Flytxt for automating intelligent digital customer interactions. A security vulnerability exists in Flytxt NEON-dX that stems from an unvalidated userId parameter in the change password function, which could lead to a brute force attack...

CVE-2023-34732

CVE-2023-34732 affects Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c. The issue is in the userId parameter of the change password function, enabling brute-force attempts to reveal user passwords. Root cause: unvalidated userId input in the change-password path. Impact: potential password dis...

Exploit for Cross-site Scripting in Jquery

SQL Injection Vulnerability in Advaya GEMS ERP Portal v2.1 ⚠️...

CVE-2024-12580 Logs Debug Injection in danny-avila/librechat

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and fileid in the /code/download/:sessionId/:fileId and /download/:userId/:fileid APIs are not validated or filtered, leading to potential log injection...