670 matches found
CVE-2021-33223
An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file...
ENTAB ERP 1.0 - Username PII leak Vulnerability
Exploit Title: ENTAB ERP 1.0 - Username PII leak Exploit Author: Deb Prasad Banerjee Vendor Homepage: https://www.entab.in Version: Entab ERP 1.0 Tested on: Windows IIS CVE: CVE-2022-30076 Vulnerability Name: Broken Access control via Rate Limits Description: In the entab software in...
CVE-2023-1557
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to...
SourceCodester E-Commerce System 访问控制错误漏洞
Moosikay E-Commerce System is an e-commerce system by the individual developer Arvin Arandilla. An access control error vulnerability exists in SourceCodester E-Commerce System version 1.0, which stems from a security issue with an unknown function in the file...
PT-2023-17073 · Sourcecodester · Sourcecodester E-Commerce System
Name of the Vulnerable Software and Affected Versions: SourceCodester E-Commerce System version 1.0 Description: A critical issue affects some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the USERID...
Sql injection
A vulnerability was found in SourceCodester Electronic Medical Records System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file administrator.php of the component Cookie Handler. The manipulation of the argument userid leads to sql...
Electronic Medical Records System SQL注入漏洞
Electronic Medical Records System is an electronic medical records system. A SQL injection vulnerability exists in SourceCodester Electronic Medical Records System version 1.0, which stems from an incorrect manipulation of the parameter userid resulting in sql injection...
PT-2023-16783 · Sourcecodester · Sourcecodester Electronic Medical Records System
Name of the Vulnerable Software and Affected Versions: SourceCodester Electronic Medical Records System version 1.0 Description: A critical issue has been found in the Cookie Handler component of the SourceCodester Electronic Medical Records System, specifically in the file administrator.php. The...
PT-2023-10154 · Unknown · Gimmie Plugin
Name of the Vulnerable Software and Affected Versions: Gimmie Plugin version 1.2.2 Description: A critical issue has been found in the Gimmie Plugin, affecting an unknown functionality of the file trigger login.php. The manipulation of the userid argument leads to sql injection. Upgrading to...
dst-admin 命令注入漏洞
dst-admin is a web program written in Java by qinming99, an individual developer. A command injection vulnerability exists in dst-admin version 1.5.0, which stems from an unknown function in the file /home/kickPlayer that can be injected with the parameter userId...
PT-2023-16424 · Dst-Admin · Dst-Admin
Name of the Vulnerable Software and Affected Versions: dst-admin version 1.5.0 Description: A critical issue has been found in the software, affecting some unknown functionality of the file /home/kickPlayer. The manipulation of the userId argument leads to command injection. The attack can be...
driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people.
Lines of code Vulnerability details Impact driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people. Proof of Concept In contract dripsHub their is no mechanism to check a user already registered under driverID or no...
CVE-2023-24058
Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservationsave.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler Sep 6, 2022 Feature...
Booked Scheduler 安全漏洞
Booked Scheduler is a powerful scheduling solution program from Booked. A security vulnerability exists in Booked Scheduler version 2.5.5. An attacker exploits the vulnerability to create and schedule events for any other user by modifying the userId value...
CVE-2022-41960 BigBlueButton contains DoS via failed authToken validation
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. Th...
CVE-2022-4281
A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched...
Authorization
A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched...
CVE-2022-4281 Facepay camera.php authorization
A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization bypass. The attack can be launched...