Nu11Secur1Ty

An issue exists where the `class` parameter allows the injection of malicious SQL queries. This can be exploited by submitting crafted payloads to manipulate database queries and potentially extract sensitive information. SQL injection is a type of flaw that occurs when an attacker can interfere with the queries that an application makes to its database.

The software contains a SQL injection issue in the `project id` parameter. Attackers can exploit this by sending specially crafted POST requests with malicious SQL payloads to manipulate database queries. Successful exploitation could allow attackers to retrieve and potentially steal the entire database content.

AimOne Video Converter version 2.04 Build 103 contains a buffer overflow in its registration form, leading to application crashes and a denial of service. An attacker can create a 7000-byte payload to trigger this issue and potentially exploit the software’s registration mechanism.

The software contains a reflected cross-site scripting issue that enables attackers to inject malicious scripts via unvalidated input parameters. Attackers can submit crafted payloads in manual insertion points to execute arbitrary JavaScript code within a victim’s browser.

Aero CMS version 0.0.1 has a SQL injection issue in the `author` parameter. This allows manipulation of database queries using boolean-based, error-based, time-based, and UNION query techniques. Successful exploitation could lead to the extraction of sensitive database information and potential system compromise.

Concrete5 CMS version 9.1.3 is subject to an XPath injection issue. Attackers can manipulate URL path parameters with malicious payloads. By sending crafted requests, attackers may be able to extract internal content paths and system information.

The software contains a JWT authentication issue due to a weak HMAC secret key implementation. This allows attackers to exploit the exposed JWT token to authenticate and gain unauthorized access, potentially with administrative permissions. Attackers can forge JWT tokens to achieve instant admin access.

Kimai version 1.30.10 has a SameSite cookie flaw that allows attackers to steal user session cookies. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, potentially leading to session hijacking.

Spip 4.1.10 is affected by a file upload issue. This allows attackers to upload malicious SVG files containing external links. An attacker can potentially trick administrators into clicking a crafted SVG logo, redirecting them to a dangerous URL due to insufficient file upload filtering. The vulnerability involves improper filtering of uploaded files, specifically SVG files, enabling the inclusion of external links within them.

The software contains a reflected cross-site scripting issue in the `language` parameter. An attacker can inject malicious scripts by crafting XSS payloads within this parameter, potentially enabling the execution of arbitrary JavaScript and the theft of user session information.

The software contains a client-side desynchronization issue related to how HTTP requests are handled. Specifically, the vulnerability stems from the parsing of the Content-Length header. An attacker can craft malicious POST requests that include smuggled secondary requests. This manipulation can potentially bypass server-side request processing controls. The `Content-Length` header is a key component in this attack.

The Bus Reservation System version 1.1 contains a SQL injection issue in the `pickup id` parameter. This allows attackers to manipulate database queries using boolean-based, error-based, and time-based blind SQL injection techniques. Successful exploitation could lead to information theft from the database.

The application has a file upload issue that permits attackers to upload arbitrary HTML files containing PHP code. This broken file upload mechanism could allow attackers to view sensitive file paths and execute malicious PHP scripts on the server.

The software contains a file upload issue that permits authenticated attackers to upload and execute malicious PHP files via the media function. An attacker with any valid account can upload PHP scripts, leading to remote code execution on the application server.

The application allows unauthenticated attackers to execute SQL queries on the server. Successful exploitation could lead to access of sensitive information and potential administrative access.

The issue concerns SQL Injection via the `username` parameter. This allows for potential unauthorized access or manipulation of data.

The issue is related to Directory Traversal.

The issue allows attackers to execute arbitrary code via a crafted file uploaded to the server. This is due to an arbitrary file upload vulnerability.

The issue allows attackers to execute arbitrary code via a crafted file uploaded to the server. This is due to an arbitrary file upload vulnerability in the system.

The issue allows attackers to execute arbitrary code via a crafted file uploaded to the server. This is due to an arbitrary file upload vulnerability.