PT-2024-39616

Name of the Vulnerable Software and Affected Versions OFCMS version 1.1.2 Description A problematic vulnerability has been found in OFCMS, affecting the add function of the file "/admin/system/dict/add.json?sqlid=system.dict.save". The manipulation of the dict value argument leads to cross-site...

CVE-2024-44845

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filterstring function...

DrayTek Vigor3900 安全漏洞

DrayTek Vigor3900 is a high-performance router for enterprise networks from China DrayTek. A security vulnerability exists in the DrayTek Vigor3900 v1.5.1.6, which originates from an authenticated command injection vulnerability via the value parameter in the filterstring function...

PT-2024-31277

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 version 1.5.1.6 Description The issue is an authenticated command injection vulnerability. It occurs via the value parameter in the filter string function. Recommendations For DrayTek Vigor3900 version 1.5.1.6, as a temporary...

CVE-2024-44845: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filterstring function...

CVE-2024-6353

The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'searchvalue' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

Online Book System 跨站脚本漏洞

Online Book System is an online booking system. A cross-site scripting vulnerability exists in code-projects Online Book System version 1.0, which stems from a cross-site scripting vulnerability in the value parameter of the /Product.php file...

Online Book System SQL注入漏洞

Online Book System is an online booking system. A SQL injection vulnerability exists in code-projects Online Book System version 1.0, which originates from a SQL injection vulnerability in the value parameter of the /Product.php file...

jose2go Security Vulnerabilities

jose2go is a Golang implementation of the Javascript object signing and encryption specification for individual developers at DV. A security vulnerability exists in jose2go versions prior to 1.6.0, which originated from a vulnerability that allows an attacker to cause a denial of service via a...

CVE-2023-51126

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 Jan 2023 the FLIR AX8 should no longer be affected by the...

CVE-2023-51126: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 Jan 2023 the FLIR AX8 should no longer be affected by the...

Teledyne FLIR AX8 Command Injection Vulnerability

Teledyne FLIR AX8 is a series of thermal surveillance cameras from Teledyne FLIR USA. The Teledyne FLIR AX8 suffers from a command injection vulnerability that stems from an arbitrary command execution vulnerability in the value parameter of the /usr/www/res.php page...

PT-2024-14053

Name of the Vulnerable Software and Affected Versions FLIR AX8 versions up to 1.46.16 Description A command injection issue exists in the /usr/www/res.php file, allowing attackers to execute arbitrary commands by manipulating the value parameter. Recommendations For FLIR AX8 versions up to 1.46.1...

CVE-2023-43705

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "translationvalue1" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...

CVE-2023-40942

Tenda AC9 V3.0BRV15.03.06.42multiTD01 was discovered stack overflow via parameter 'firewallvalue' at url /goform/SetFirewallCfg...

PT-2023-27710

Name of the Vulnerable Software and Affected Versions Tenda AC9 version V3.0BR V15.03.06.42 multi TD01 Description A stack overflow issue was discovered via the firewall value parameter at the "/goform/SetFirewallCfg" API endpoint. Recommendations For Tenda AC9 version V3.0BR V15.03.06.42 multi...

CVE-2023-38767

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...

PT-2023-26595 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 5.0.0 Description: A SQL injection issue allows a remote attacker to obtain sensitive information via the value and custom parameters within the "/QueryView.php" API endpoint. Recommendations: For ChurchCRM version 5.0.0, as...

CVE-2023-38767

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...

CVE-2023-38767: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...