CVE-2024-47651

This vulnerability exists in Shilpi Client Dashboard due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this vulnerability by including multiple “userid” parameters in the API request body leading to unauthorized access of sensitive...

CVE-2023-26770

CVE-2023-26770 affects TaskCafe 0.3.2 and is caused by lack of validation in the Cookie value. An unauthenticated attacker who knows a registered UserID can change that user’s password. Public sources (NVD/Red Hat/OSV) describe the issue identically. The Red Hat/NVD entries note no public details...

CVE-2023-26770

TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user...

CVE-2024-43283 WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through = 23.1.2...

CVE-2024-7503

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'wooslgconfirmemailuser' function. This makes it possible for unauthenticated attackers to l...

CVE-2024-6009

A vulnerability has been found in itsourcecode Event Calendar 1.0 and classified as critical. Affected by this vulnerability is the function regConfirm/regDelete of the file process.php. The manipulation of the argument userId leads to sql injection. The attack can be launched remotely. The explo...

CVE-2024-6009

A vulnerability has been found in itsourcecode Event Calendar 1.0 and classified as critical. Affected by this vulnerability is the function regConfirm/regDelete of the file process.php. The manipulation of the argument userId leads to sql injection. The attack can be launched remotely. The explo...

CVE-2024-34582

Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi useridchange XSS within the Forgot Password feature...

Sunhillo SureLine 跨站脚本漏洞

Sunhillo SureLine is a monitoring product from Sunhillo USA. A cross-site scripting vulnerability exists in Sunhillo SureLine RICI 5000 version 8.10.0 and earlier, which stems from the cgi/usrPasswd.cgi useridchange in the Forgot Password function containing cross-site scripting...

CVE-2024-33818

Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference IDOR via the userID parameter...

CVE-2024-33818

CVE-2024-33818 concerns Globitel KSA SpeechLog v8.1, where an Insecure Direct Object Reference (IDOR) is exposed via the userID parameter. Multiple connected sources corroborate that the vulnerability exists in SpeechLog Analytics v8.1 and is triggered remotely (attack vector: network) with low c...

CVE-2024-33818

Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference IDOR via the userID parameter...

CVE-2024-33818

Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference IDOR via the userID parameter...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...

PT-2024-24185 · Unknown · Kliqqi-Cms

Name of the Vulnerable Software and Affected Versions: Kliqqi-CMS version 2.0.2 Description: The issue is related to SQL Injection in the load data.php file via the userid parameter. This allows for potential exploitation. Recommendations: For Kliqqi-CMS version 2.0.2, consider restricting access...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data.php via the userid parameter. Reported as CVE-2024-31673; CVSS 3.1 base score 9.8 (Network, Privileges NONE, User Interaction NONE; Confidentiality/Integrity/Availability: HIGH). Root cause: improper handling of the userid input enablin...

CVE-2024-31673

Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in loaddata.php via the userid parameter...

PT-2024-26384

Name of the Vulnerable Software and Affected Versions Campcodes Online Event Management System version 1.0 Description A critical issue has been discovered, affecting the /api/process.php file. The manipulation of the userId argument leads to sql injection, allowing remote attacks. The issue has...