CVE Vulnerability Catalog

CVE-2023-3651 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Digital Ant E-Commerce Software.

CVE-2023-3716 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Oduyo Online Collection Software.

A SQL injection vulnerability was discovered in Judging Management System v1.0 via the id parameter in /php-jms/deductScores.php.

Advantech EKI-1524, EKI-1522, and EKI-1521 devices up to version 1.21 are affected by a Stored Cross-Site Scripting vulnerability that can be triggered by authenticated users in the ping tool of the web interface.

Advantech EKI-1524, EKI-1522, and EKI-1521 devices up to version 1.21 are affected by a Stored Cross-Site Scripting vulnerability that can be triggered by authenticated users in the device name field of the web interface.

CVE-2023-3717 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Farmakom Remote Administration Console. This issue affects versions of the console before 1.02.

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4) that is vulnerable to SQL injection. This could allow unauthenticated remote attackers to execute arbitrary SQL queries on the server database.

CVE-2023-3898 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in mAyaNet E-Commerce Software versions before 1.1.

In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request related to date/time operations to gain full access to the device.

In PHOENIX CONTACT's TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10, there is a vulnerability to reflective XSS in the license viewer page. An unauthenticated remote attacker could exploit this vulnerability to execute code in the context of the user's browser.

The log_blackbox.c file in libqb before version 2.0.8 has a buffer overflow vulnerability due to long log messages, as the header size is not considered.

SAP PowerDesigner version 16.7 has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy.

PrestaShop is an open source e-commerce application that is vulnerable to remote code execution through SQL injection and arbitrary file write in the back office in versions prior to 1.7.8.10, 8.0.5, and 8.1.1.

Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6, and FH1205 V2.0.0.7 were found to contain a stack overflow vulnerability via the ssid parameter in the form_fast_setting_wifi_set function.

Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were found to have a stack overflow vulnerability via the mit_ssid parameter in the formWrlsafeset function.

Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5, and FH1202 V1.2.0.9 were found to have a stack overflow vulnerability via the page parameter at /L7Im.

Tenda AC10, AC1206, AC8, AC6, AC7, AC5, AC9, and AC10 v4.0 devices were found to contain a stack overflow via the list parameter in the formSetVirtualSer function.

Tenda AC10, AC1206, AC6, AC7, AC5, FH1203, AC9, and FH1205 devices were found to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.

Tenda AC1206, AC8, AC5, AC10, and AC9 devices were found to contain a buffer overflow vulnerability in the formSetQosBand function via the list parameter.

Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6, and FH1205 V2.0.0.7 were found to have a stack overflow vulnerability via the deviceId parameter in the formSetDeviceName function.