CVE Vulnerability Catalog

CVE-2023-38044 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities.

CVE-2023-34477 vulnerability concerns improper neutralization of special elements used in SQL commands, leading to SQL injection.

CVE-2023-34476 vulnerability concerns improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks.

There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.

A vulnerability in LangChain version 0.0.194 allows remote code execution via the from_math_prompt and from_colored_object_prompt functions in the PALChain class. An attacker can inject malicious Python code through the eval mechanism.

A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.

The social-media-skeleton project has a SQL injection vulnerability that allows UNION based injections, which indirectly leads to remote code execution. A fix has been introduced in commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1.

PHPGurukul Online Security Guards Hiring System version 1.0 is vulnerable to SQL Injection via osghs/admin/search.php.

Knowage is an open source analytics and business intelligence suite. In versions from 6.x.x to prior to 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload template files to the server without requiring authorization, enabling code execution on the server.

An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks.

MindsDB's AI Virtual Database prior to version 23.7.4.0 allowed disabling SSL certificate verification using `verify=False`. In version 23.7.4.0, SSL certificate verification is enabled by default, which is the desired behavior.

CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management.

Connected IO version 2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication. This allows devices to connect to the broker and issue commands to other devices, impersonating the Connected IO management platform.

Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.

Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command, allowing attackers to execute arbitrary OS commands on devices.

Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.

Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices.

Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution.

Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices.

Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware for device communication using MQTT. An attacker who gains access to these credentials can connect to the MQTT broker and send messages on behalf of devices, impersonating them.