Windhxy

**Nome do Software Vulnerável e Versões Afetadas** dresende node-sql-query versões 0.1.25 a 0.1.28 **Description** Um problema de injeção de SQL existe no componente Request Parameter Handler dentro da biblioteca `lib/Select.js`. A falha está localizada nas funções `SelectQuery.from()` e `SelectQuery.build()`, permitindo que um invasor remoto realize uma manipulação que resulte na execução de comandos SQL arbitrários. **Recommendations** Atualize para a versão 0.1.29.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Student Information Management System version 1.0 **Description** A vulnerability exists in itsourcecode Student Information Management System version 1.0. The issue is a SQL injection affecting an unknown function within the `/admin/modules/class/index.php` file. The `classId` argument can be manipulated to trigger the injection. This manipulation can be initiated remotely. The exploit has been publicly disclosed. **Recommendations** As a temporary workaround, consider restricting access to the `/admin/modules/class/index.php` file until a fix is available.