Y4G0

A critical vulnerability was found in Econtrata, affecting an unknown function of the file /valida. The manipulation of the argument `usuario` leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond.

A vulnerability was found in Drivin Soluções, affecting the /api/school/registerSchool API endpoint of the API Handler component. The manipulation of the `message` argument leads to cross-site scripting. The attack can be initiated remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue affects some unknown functionality of the component Esqueceu a senha. The manipulation of the `txtCPF` argument leads to SQL injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

A critical vulnerability was found in Quantico Tecnologia PRMV, affecting an unknown part of the file `/admin/login.php` of the component Login Endpoint. The manipulation of the `username` argument leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was found in the API Handler component of Control iD RH iD, affecting an unknown part of the file /v2/customerdb/person.svc/change password. The manipulation of the `message` argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in the PDF Document Handler component of Control iD RH iD, affecting unknown code of the file "/v2/report.svc/comprovante marcacao/?companyId=1". The manipulation of the `nsr` argument leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A critical issue was found in the Login Endpoint component, specifically in the /login.aspx file, where manipulation of the `txtUsuario` argument leads to sql injection. This issue can be exploited remotely.

A critical vulnerability has been found in the Login Endpoint component of Pixsoft E-Saphira, affecting the file "/servlet?act=login&tipo=1". The manipulation of the `txtUsuario` argument leads to SQL injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A critical issue affects some unknown processing of the file "/pix projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041" of the component Login Endpoint. The manipulation of the argument `txtUsuario` leads to SQL injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in the Login Endpoint component of Pixsoft Vivaz. The manipulation of the `sistema` argument in the "/servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231" endpoint leads to cross-site scripting. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue affects some unknown functionality of the file /Home/JS CarregaCombo?formName=DADOS PESSOAIS PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS PESSOAIS PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc& =1739290047295. The manipulation leads to sql injection. The attack may be launched remotely.

A critical issue has been identified in Benner ModernaNet, affecting unknown code in the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the `fooId` argument leads to improper control of resource identifiers, allowing remote attacks. Upgrading to version 1.1.1 can address this issue.

A vulnerability was found in the processing of the file /DadosPessoais/SG AlterarSenha, leading to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.1.1 is able to address this issue.

A problematic issue has been found, affecting an unknown function of the file /DadosPessoais/SG Gravar. The manipulation of the `idItAg` argument leads to cross-site request forgery. This issue can be exploited remotely.

A critical issue was discovered in the software, affecting an unknown functionality related to the file /Usuarios/Usuario/EditarLogado/. The manipulation of the `Handle` argument leads to improper control of resource identifiers, allowing for remote attacks. The vendor was contacted about this issue but did not respond.

A critical issue has been found in Benner ModernaNet, affecting an unknown part of the file `/AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0& =1739371223797`. The manipulation leads to SQL injection, and it is possible to initiate the attack remotely. Upgrading to version 1.1.1 can address this issue.

A problematic issue has been found in the New Ticket Handler component, where the manipulation of the `subject` argument leads to cross-site scripting. This can be initiated remotely.

A problematic issue was found in Zenvia Movidesk, affecting some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of the `username` argument leads to cross-site scripting. The attack may be launched remotely.

A vulnerability was found in Zenvia Movidesk, affecting an unknown functionality of the file /Account/Login. The manipulation of the `ReturnUrl` argument leads to open redirect. The attack can be launched remotely.