Publikacje w kolejności czasu

Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site…

A vulnerability was detected in code-projects Content Management System 1.0. The affected element is an unknown function of the file /pages.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

A flaw has been found in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Frontend/ViewSongs.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/edit_posts.php. The manipulation of the argument image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been…

SQL injection in gosaliajainam/online-movie-booking 5.5 in movie_details.php allows attackers to gain sensitive information.

A weakness has been identified in code-projects Content Management System 1.0. This issue affects some unknown processing of the file /admin/delete.php. Executing a manipulation of the argument del can lead to sql injection. The attack can be executed remotely. The exploit has been made available…

A vulnerability was determined in code-projects Content Management System 1.0. This impacts an unknown function of the file search.php. This manipulation of the argument Value causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may…

Wstrzyknięcie SQL w Yonyou KSOA 9.0 umożliwia zdalne wykonanie ataku.

Wstrzyknięcie SQL w Yonyou KSOA 9.0 umożliwia zdalne wykonanie nieautoryzowanych zapytań.

Wstrzyknięcie SQL w Yonyou KSOA 9.0 umożliwia zdalne wykonanie ataku.

Wstrzyknięcie SQL w Yonyou KSOA 9.0 umożliwia zdalne wykonanie kodu.

Wstrzyknięcie SQL w Yonyou KSOA 9.0 umożliwia zdalne wykonanie ataku.

Wstrzyknięcie SQL w Yonyou KSOA 9.0 umożliwia zdalne wykonanie ataku.

Wstrzyknięcie SQL w Yonyou KSOA 9.0 umożliwia zdalne ataki na bazę danych.

Wstrzyknięcie SQL w Online Guitar Store umożliwia zdalne ataki na bazę danych.

Eksploatacja Signal K Server umożliwia kradzież tokenów JWT bez uwierzytelnienia.

Wstrzyknięcie SQL w Online Guitar Store umożliwia zdalne manipulowanie danymi.

Wstrzyknięcie SQL w Online Guitar Store umożliwia zdalne wykonanie ataku.

Wstrzyknięcie SQL w Online Guitar Store umożliwia zdalne manipulowanie danymi.

A security flaw has been discovered in itsourcecode School Management System 1.0. This affects an unknown part of the file /student/index.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and…

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens…

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version…

A weakness has been identified in D-Link DIR-806A 100CNb11. Affected is the function ssdpcgi_main of the component SSDP Request Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. This…

Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system.

Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.