682 matches found
CVE-2025-1812 zj1983 zz SuperZ.java GetUserOrg sql injection
A vulnerability classified as critical has been found in zj1983 zz up to 2024-08. Affected is the function GetUserOrg of the file com/futvan/z/framework/core/SuperZ.java. The manipulation of the argument userId leads to sql injection. It is possible to launch the attack remotely. The exploit has...
PT-2025-9193 · Zj1983 Zz · Zj1983 Zz
Name of the Vulnerable Software and Affected Versions: zj1983 zz versions up to 2024-8 Description: A critical issue was found in the function getUserOrgForUserId of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument userID leads to SQL injection. Th...
CVE-2024-33818
Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference IDOR via the userID parameter...
CVE-2024-7503
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'wooslgconfirmemailuser' function. This makes it possible for unauthenticated attackers to l...
CVE-2024-11127
A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploi...
Lingdang CRM SQL注入漏洞
Lingdang CRM Lingdang CRM is a customer relationship management system from China Lingdang Lingdang company. A SQL injection vulnerability exists in Lingdang CRM 8.6.4.3 and earlier versions, which originates from the parameter userid in the file...
PT-2024-16779 · Unknown · Code-Projects Job Recruitment
Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A critical issue has been found in the code-projects Job Recruitment software. The problem affects an unknown functionality of the file admin.php. The manipulation of the userid argument...
PT-2024-16774 · Unknown · Lingdang Crm
Name of the Vulnerable Software and Affected Versions: Lingdang CRM versions up to 8.6.4.3 Description: A critical issue was found in the software, affecting an unknown functionality of the file /crm/WeiXinApp/marketing/index.php?module=Users&action=getActionList. The manipulation of the userid...
CVE-2024-10927
A vulnerability was found in MonoCMS up to 20240528. It has been classified as problematic. Affected is an unknown function of the file /monofiles/account.php of the component Account Information Page. The manipulation of the argument userid leads to cross site scripting. It is possible to launch...
CVE-2024-10927 MonoCMS Account Information Page account.php cross site scripting
A vulnerability was found in MonoCMS up to 20240528. It has been classified as problematic. Affected is an unknown function of the file /monofiles/account.php of the component Account Information Page. The manipulation of the argument userid leads to cross site scripting. It is possible to launch...
MonoCMS 注入漏洞
MonoCMS is a content management system from MonoCMS, Inc. An injection vulnerability exists in MonoCMS 20240528 and prior versions, which stems from a cross-site scripting attack due to improper handling of the parameter userid...
CVE-2024-9613
The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress plugin FormFacade 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2022-30358
OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and newPsw parameters. Authentication is required...
CVE-2022-30357
OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required...
CVE-2022-30357
OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required...
CVE-2022-30355
OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required...
PT-2024-11553 · Ovaledge · Ovaledge
Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...
CVE-2022-30355
OvalEdge 5.2.8.0 and earlier are affected by an Account Takeover vulnerability. The issue allows exploitation via a POST to /profile/updateProfile using userId and email parameters, with authentication required. Multiple connected sources confirm the affected versions and the vulnerable endpoint....