‼ CVE-2022-31336 ‼
📖 Read
via "National Vulnerability Database".
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/loaddata.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-12350 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36866 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30809 ‼
📖 Read
via "National Vulnerability Database".
elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_page.php?page=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30834 ‼
📖 Read
via "National Vulnerability Database".
Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_manage_account_details.php?booking_id=31&user_id=📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31335 ‼
📖 Read
via "National Vulnerability Database".
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/index.php?view=edit&id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30034 ‼
📖 Read
via "National Vulnerability Database".
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29712 ‼
📖 Read
via "National Vulnerability Database".
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31347 ‼
📖 Read
via "National Vulnerability Database".
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_vehicle.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1797 ‼
📖 Read
via "National Vulnerability Database".
A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23237 ‼
📖 Read
via "National Vulnerability Database".
E-Series SANtricity OS Controller Software 11.x versions through 11.70.2 are vulnerable to host header injection attacks that could allow an attacker to redirect users to malicious websites.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32201 ‼
📖 Read
via "National Vulnerability Database".
In libjpeg 1.63, there is a NULL pointer dereference in Component::SubXOf in component.hpp.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27781 ‼
📖 Read
via "National Vulnerability Database".
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31953 ‼
📖 Read
via "National Vulnerability Database".
Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32003 ‼
📖 Read
via "National Vulnerability Database".
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/view_court.php?id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30831 ‼
📖 Read
via "National Vulnerability Database".
Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31343 ‼
📖 Read
via "National Vulnerability Database".
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=bookings/view_details&id=.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42199 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in swftools through 20201222. A heap buffer overflow exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. It allows an attacker to cause code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31966 ‼
📖 Read
via "National Vulnerability Database".
ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simple_chat_bot/classes/Master.php?f=delete_img.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-30999 ‼
📖 Read
via "National Vulnerability Database".
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32001 ‼
📖 Read
via "National Vulnerability Database".
Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/products/view_product.php?id=.📖 Read
via "National Vulnerability Database".