CVE-2023-46304

CVE-2023-46304 VTiger 开源 CRM v7.5 中的认证远程代码执行漏洞 摘要 当前发行的 VTiger CRM 开源版本 7.5.0 的 Users 模块中存在一个漏洞，允许经过认证的攻击者向 config.inc.php 写入并执行任意 PHP 代码。 漏洞详情 当用户正常认证到 VTiger 时，系统会检查其设置状态，以判断是否为尚未完全配置的新用户。同时也会检查是否为第一个用户（即应配置某些全局属性的管理员）。如果是，则会被重定向到 Users 模块中的 UserSetup 操作。 $userSetupStatus =...

CVE-2023-51810

CVE-2023-51810 描述 StackIdeas EasyDiscuss v.5.0.5 中存在盲 SQL 注入漏洞，远程攻击者可通过 Users 模块中的 search 参数获取敏感信息。 产品 StackIdeas EasyDiscuss v5.0.5 - EasyDiscuss - Joomla 论坛讨论工具 - StackIdeas 修复方案 升级至 = 5.0.10 的版本。由于缺乏公开可用的源代码，版本 5.0.6-5.0.9 未进行测试。 步骤 安装在 Joomla 上的 EasyDiscuss 插件（v5.0.5）存在盲 SQL 注入漏洞： 该漏洞存在于...

CVE-2026-93014: Improper Limitation of a Pathname to a Restricted Directory

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-13555

A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/modusers/controller.php?action=add. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploi...

CVE-2019-25664

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...

CVE-2019-25664

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...

CVE-2019-25664 SuiteCRM 7.10.7 SQL Injection via record Parameter

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...

CVE-2019-25664: Improper Neutralization of Special Elements used in an SQL Command

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...

itsourcecode Free Hotel Reservation System SQL注入漏洞

itsourcecode Free Hotel Reservation System is an open-source hotel reservation system developed by itsourcecode. Version 1.0 of the system has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter accountid in the file /hotel/admin/modusers/index.php,...

CVE-2021-47918

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application...

CVE-2021-47918

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application...

CVE-2021-47916

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2022-50940

Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script code in the name parameter. Attackers can exploit the vulnerability to execute arbitrary scripts in users and activity log backend modules, potentially...

CVE-2021-47918 Simple CMS 2.1 SQL Injection Vulnerability via Users Module

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application...

CVE-2021-47918 Simple CMS 2.1 SQL Injection Vulnerability via Users Module

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application...

EUVD-2021-34753

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application...

CVE-2021-47918

CVE-2021-47918 concerns Simple CMS 2.1 with a remote SQL injection in the users module. The vulnerability arises from unvalidated input in the admin.php handler, allowing an attacker with privileges to inject arbitrary SQL commands, potentially compromising both the database management system and...

CVE-2021-47918

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application...

CVE-2021-47916

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2021-47916

The EUVD entry EUVD-2021-34755 documents a vulnerability in Simple CMS 2.1: a remote SQL injection that lets an attacker inject unvalidated SQL via the users module, exploiting unvalidated input in admin.php to compromise the database management system and the web application. The connected docum...