CVE-2023-2832

CVE-2023-2832 concerns the Unilogies Bumsys project (unilogies/bumsys) with SQL injection in versions prior to 2.2.0. The vulnerability stems from building SQL queries by appending user-supplied values (customerId, empId, company_id) without proper quoting, leading to injection and potential dela...

CVE-2023-1361

CVE-2023-1361 : SQL Injection in the open-source project unilogies/bumsys prior to v2.0.2. The vulnerability stems from core/ajax/ajax_data.php where customer_id is sanitized but interpolated into an unquoted numeric context, allowing injected SQL (example PoC in Huntr shows a time-based sleep). ...

CVE-2023-2554

CVE-2023-2554 affects unilogies/bumsys prior to 2.2.0. The issue is External Control of File Name or Path, enabling path traversal via user-supplied input used to build file paths in easyUpload, potentially allowing arbitrary file write. Public sources (NVD/Red Hat/Rust) rate severity as HIGH (CV...