CVE-2022-32024

Car Rental Management System v1.0 is affected by an SQL Injection via /booking.php?car_id=, as described in multiple connected sources. The vulnerability arises from improper handling of user-supplied car_id input, allowing an attacker to execute arbitrary SQL queries with the potential to read, ...

CVE-2022-32025

CVE-2022-32025 : The Car Rental Management System 1.0 is vulnerable to an SQL injection through the parameter in /admin/view_car.php?id=. An attacker could potentially view, modify, or delete data and perform unauthorized administrative operations within the affected site. The provided nuclei tem...

CVE-2022-32026

Car Rental Management System v1.0 is affected by an SQL injection vulnerability in the parameter id of the manage_booking.php script (paths include /admin/manage_booking.php?id= or /car-rental-management-system/admin/manage_booking.php?id=). The connected documents describe an SQLi flaw that coul...

CVE-2022-32028

CVE-2022-32028 affects Car Rental Management System 1.0. The Nuclei templates document an SQL injection in the admin interface via /admin/manage_user.php?id=. Successful exploitation could lead to sensitive data exposure and data manipulation; impact/precise exploitation are described in the conn...

CVE-2022-30190

Technical details beyond the MSDT/Follina description are not provided in the connected documents. Public specifics (affected versions, exploit paths, patches) are not available here; monitor for updates.

CVE-2022-25237

CVE-2022-25237 concerns Bonita Web 2021.2. An authentication/authorization bypass occurs due to an overly broad exclude pattern in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoint...

CVE-2022-30425

Affected product : Tenda HG6 router (firmware/software version 3.3.0-210926, HG6). Vulnerability : OS command injection via HTTP POST parameters in the formPing/formPing6 and formTracert/formTracert6, exploiting unfiltered input in the pingAddr and traceAddr fields. Root cause : failure to proper...

CVE-2022-22675

CVE-2022-22675 is an Apple kernel-related out-of-bounds write vulnerability (AppleAVD) that could allow code execution with kernel privileges. Affected macOS Big Sur 11.x, Monterey, tvOS, watchOS, iOS, and iPadOS components were fixed in specific updates: tvOS 15.5, watchOS 8.6, macOS Big Sur 11....

CVE-2022-22674

CVE-2022-22674 involves an out-of-bounds read in the Intel Graphics Driver on macOS, allowing a local attacker to read kernel memory. Apple fixed it with patches in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, and macOS Big Sur 11.6.6 by improving input validation/bounds checks. Ther...

CVE-2022-20821

Cisco IOS XR Software health check RPM opens port 6379 by default, exposing the Redis instance inside the NOSi container to unauthenticated remote access. This could allow writing to the Redis in-memory DB, writing arbitrary files to the container filesystem, and retrieving Redis data. The vulner...

CVE-2022-26833

The CVE-2022-26833 issue affects Open Automation Software OAS Platform V16.00.0121. A vulnerability in the REST API allows unauthenticated use via a crafted sequence of HTTP requests, stemming from improper authentication. Consequences cited in the sources include unauthenticated access to the RE...

CVE-2022-0781

CVE-2022-0781 affects the WordPress Nirweb Support plugin (versions before 2.8.2). The vulnerability is an SQL injection caused by inadequate sanitization/escaping of a parameter in an AJAX action, accessible to unauthenticated users. Exploitation could lead to unauthorized data access, data mani...

CVE-2022-0346

CVE-2022-0346 affects the WordPress XML Sitemap Generator for Google plugin (versions before 2.0.4). The connected Nuclei template confirms a cross-site scripting vulnerability caused by improper validation of a parameter that can be set to an arbitrary value, enabling XSS via error messages or r...

CVE-2022-22972

CVE-2022-22972 is an authentication bypass affecting VMware Workspace ONE Access, Identity Manager, and vRealize Automation. A malicious actor with network access to the UI could obtain administrative access without authentication. Public materials (CVEs, vendor advisories) confirm affected produ...

CVE-2022-22973

CVE-2022-22973 is a local privilege escalation affecting VMware Workspace ONE Access and VMware Identity Manager. The root cause is improper permissions/handling in support scripts, permitting an attacker with local access to escalate to root. Affected product lines include Workspace ONE Access a...

CVE-2022-28987

Vulnerability summary: Zoho ManageEngine ADSelfService Plus (pre-6202, e.g., 6121) is affected by CVE-2022-28987. A crafted POST to /ServletAPI/accounts/login enables username enumeration by revealing differences in responses for existing versus non-existing users, via the Forgot Password/login f...

CVE-2022-21500

CVE-2022-21500 affects Oracle E-Business Suite, specifically the Manage Proxies component, with the vulnerable line item in 12.2 (12.1 is not impacted). The issue enables an attacker to access or potentially take over data in the Oracle E-Business Suite via HTTP over the network, with CVSSv3.1 ba...

CVE-2022-28956

CVE-2022-28956 affects the D-Link DIR816L router, specifically the getcfg.php component in firmware FW206b01. The root cause is described as errors in the getcfg.php code that allow an unauthenticated attacker to access the device via a crafted payload, with impact described as partial confidenti...

CVE-2022-1386

CVE-2022-1386 : The WordPress Fusion Builder plugin (before 3.6.2) used with the Avada theme is vulnerable to a server-side request forgery (SSRF). The plugin does not validate a parameter in its forms, allowing an attacker to initiate arbitrary HTTP requests, with the response echoed back to the...

CVE-2022-0867

The CVE-2022-0867 entry concerns WordPress ARPrice/Pricing Table plugins (pre-3.6.1). The vulnerability is a SQL injection caused by improper sanitization/escaping of POST data, which is interpolated into an SQL statement and executed via an AJAX action that unauthenticated users can access. Docu...