CVE-2022-28079

CVE-2022-28079 affects College Management System 1.0. A SQL injection vulnerability exists in the course_code parameter, enabling exploitation that can lead to unauthorized access, data leakage, and potential database manipulation. Public references (NVD/Nuclei/ExploitDB) confirm the issue and in...

CVE-2021-41739

The CVE-2021-41739 issue affects Artica Proxy 4.30.000000, where an OS Command Injection is possible via cyrus.events.php using the GET parameter logs and the POST parameter rp. Multiple connected sources confirm the vulnerability and describe the root cause as lack of input filtering/escaping on...

CVE-2021-43163

CVE-2021-43163 concerns a Remote Code Execution in Ruijie RG-EW Series Routers running ReyeeOS up to 1.55.1915 / EW_3.0(1)B11P55. The vulnerability originates from the checkNet function in /cgi-bin/luci/api/auth, allowing an attacker to execute arbitrary code on affected devices. Connected source...

CVE-2022-1281

The CVE-2022-1281 issue affects the WordPress Photo Gallery plugin up to version 1.6.3, where the $_POST['filter_tag'] parameter is not properly escaped before being appended to an SQL query, enabling SQL Injection attacks. Multiple connected advisories confirm the root cause and impact as unauth...

CVE-2022-0952

CVE-2022-0952 affects the WordPress Sitemap by click5 plugin under versions before 1.0.36. The issue is missing authorization/CSRF checks when updating options via a REST endpoint and the update may not verify that the option belongs to the plugin. This allows unauthenticated attackers to change ...

CVE-2022-28054

The CVE-2022-28054 entry affects VanDyke Software VShell for Windows 4.6.2. The root cause is improper sanitization/cleanup of trigger action scripts, which enables an attacker to execute arbitrary code by supplying a crafted value. Impact is high: remote code execution with network access and no...

CVE-2021-40822

GeoServer versions 2.18.5 and 2.19.x up to 2.19.2 are affected by an SSRF vulnerability via the proxy host configuration. The issue is mitigated in later releases (notably 2.19.3 and beyond); broader fixes in 2.24.4/2.25.2 address related TestWfsPost servlet exposure. Remediation: upgrade to a fi...

Zendo is vulnerable to SQL injection

Zendo is a homegrown open source project management software. Zendo suffers from an SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2022-29081

CVE-2022-29081 affects Zoho ManageEngine products: Access Manager Plus (before 4302), Password Manager Pro (before 12007), and PAM360 (before 5401). The issue is an access-control bypass on certain REST API endpoints (SSOutAction, SSLAction, LicenseMgr, GetProductDetails, GetDashboard, FetchEvent...

CVE-2021-46422

CVE-2021-46422 affects Telesquare SDT-CW3B1 1.1.0 with an OS command injection vulnerability that allows remote command execution without authentication. The NVD entry lists a CVSS v3.1 base score of 9.8 (CRITICAL), with network access, no user interaction, and high impact to confidentiality, int...

CVE-2021-46442

Summary of CVE-2021-46442 : Affected product is the D-Link DIR-825 G1 router, specifically the webupg binary. The vulnerability allows an attacker to bypass authentication via the parameter involved in the autoupgrade.asp flow, enabling unauthorized actions such as downloading configuration files...

CVE-2022-29499

The CVE-2022-29499 vulnerability affects the Service Appliance component in Mitel MiVoice Connect (SA 100, SA 400, Virtual SA) through 19.2 SP3, due to incorrect data validation that enables remote code execution. Impact is documented as Remote Code Execution with high/severe CVSS scores (up to 9...

CVE-2022-24706

CVE-2022-24706 affects Apache CouchDB before 3.2.2, where an attacker can access an improperly secured default installation without authentication and gain admin privileges due to an access-control flaw. Affected versions include 3.2.1 and earlier; remediation is to upgrade to CouchDB 3.2.2 (or a...

CVE-2021-35250

Summary (CVE-2021-35250): SolarWinds Serv-U 15.3 is affected by a directory traversal/local file inclusion vulnerability. The issue enables an attacker to access files related to the Serv-U installation and server files, potentially exposing sensitive information. The root cause is a path travers...

CVE-2022-28290

CVE-2022-28290 affects the WordPress Country Selector plugin until version 1.6.5. The vulnerability is a reflected Cross-Site Scripting (XSS) issue where the plugin does not sanitize/escape the country and lang parameters before output, enabling arbitrary script execution in the user’s browser (c...

CVE-2022-1390

CVE-2022-1390 affects the WordPress plugin Admin Word Count Column (versions

CVE-2022-0769

Summary (concrete details from connected docs): CVE-2022-0769 affects the WordPress plugin Users Ultra up to version 3.1.0 . The vulnerability stems from improper sanitization/escaping of the data_target parameter before it is interpolated into an SQL statement, which is then executed via the rat...

CVE-2022-0656

The CVE-2022-0656 issue affects the WordPress plugin Web To Print Shop: uDraw , where versions prior to 3.3.3 do not validate the URL parameter in the AJAX action udraw_convert_url_to_base64 before using it in file_get_contents, enabling unauthenticated arbitrary file reads (e.g., /etc/passwd, wp...

CVE-2021-25094

CVE-2021-25094 affects the WordPress Tatsu plugin prior to 3.3.12. An unauthenticated attacker can upload a crafted ZIP via add_custom_font, decompose it on the WordPress uploads path, and place a PHP shell (filename starting with a dot) to bypass extension controls. A race condition during ZIP e...

CVE-2022-29078

CVE-2022-29078 affects Node.js ejs, version 3.1.6. The vulnerability is a server-side template injection in settings[view options][outputFunctionName], where input is parsed as an internal option and can overwrite outputFunctionName to execute an arbitrary OS command during template compilation. ...