Skip to content
OpenAdvisories

Archive

21 December 2023

Vulnerabilities first published on this day (UTC), newest first.

← November 2023 2023 / December /21 January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-49689

    Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.

    Kashipara Job Portal
  • Critical 9.8
    CVE-2023-49688

    Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.

    Kashipara Job Portal
  • Critical 9.8
    CVE-2023-49681

    Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertWalkin.php resource does not validate the characters received and they are sent unfiltered to the database.

    Kashipara Job Portal
  • Critical 9.8
    CVE-2023-49677

    Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertJob.php resource does not validate the characters received and they are sent unfiltered to the database.

    Kashipara Job Portal
  • Critical 9.8
    CVE-2023-48722

    Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_results.php resource does not validate the characters received and they are sent unfiltered to the database.

    Projectworlds Pvt Student Result Management System
  • Critical 9.8
    CVE-2023-48720

    Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.

    Projectworlds Pvt Student Result Management System
  • Critical 9.8
    CVE-2023-48718

    Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_students.php resource does not validate the characters received and they are sent unfiltered to the database.

    Projectworlds Pvt Student Result Management System
  • Critical 9.8
    CVE-2023-48716

    Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_id' parameter of the add_classes.php resource does not validate the characters received and they are sent unfiltered to the database.

    Projectworlds Pvt Student Result Management System
  • Critical 9.8
    CVE-2023-48689

    Railway Reservation System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'byname' parameter of the train.php resource does not validate the characters received and they are sent unfiltered to the database.

    Projectworlds Pvt Railway Reservation System
  • Critical 9.8
    CVE-2023-48687

    Railway Reservation System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'from' parameter of the reservation.php resource does not validate the characters received and they are sent unfiltered to the database.

    Projectworlds Pvt Railway Reservation System
  • Critical 9.8
    CVE-2023-48685

    Railway Reservation System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

    Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'psd' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.

    Projectworlds Pvt Railway Reservation System
  • Critical 9.8
    CVE-2023-6145

    SQLi in Softomi E-commerce Software

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Advanced C2C Marketplace Software allows SQL Injection. This issue affects Softomi Advanced…

    İstanbul Soft Informatics and Consultancy Limited Company Softomi Advanced C2C Marketplace Software
  • Critical 9.8
    CVE-2023-32242

    WordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36.

    Xtemos WoodMart - Multipurpose WooCommerce Theme Web / CMS
  • Critical 10.0
    CVE-2023-49778

    WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.

    Hakan Demiray Sayfa Sayac
  • Critical 9.8
    CVE-2023-51656

    Apache IoTDB: Unsafe deserialize map in Sync Tool

    Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue.

    Apache Software Foundation Apache IoTDB org.apache.iotdb:iotdb-parent Maven
  • Critical 9.1
    CVE-2023-50475

    bsock uses weak hashing algorithms

    An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithms in the component \vendor\faye-websocket.js.

    bsock npm
  • Critical 9.8
    CVE-2023-29486

    An issue was discovered in Heimdal Thor agent versions 3.4.2 and before 3.7.0 on Windows, allows attackers to bypass US…

  • Critical 9.8
    CVE-2023-51051

    S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.

  • Critical 9.8
    CVE-2023-51052

    S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.