Yago Martins

A critical vulnerability was found in Quantico Tecnologia PRMV, affecting an unknown part of the file `/admin/login.php` of the component Login Endpoint. The manipulation of the `username` argument leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A critical issue affects some unknown functionality of the component Esqueceu a senha. The manipulation of the `txtCPF` argument leads to SQL injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

A critical issue was found in the Login Endpoint component, specifically in the /login.aspx file, where manipulation of the `txtUsuario` argument leads to sql injection. This issue can be exploited remotely.

A critical issue was discovered in the software, affecting an unknown functionality related to the file /Usuarios/Usuario/EditarLogado/. The manipulation of the `Handle` argument leads to improper control of resource identifiers, allowing for remote attacks. The vendor was contacted about this issue but did not respond.

A critical issue has been found in Benner ModernaNet, affecting an unknown part of the file `/AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0& =1739371223797`. The manipulation leads to SQL injection, and it is possible to initiate the attack remotely. Upgrading to version 1.1.1 can address this issue.

A critical issue affects some unknown functionality of the file /Home/JS CarregaCombo?formName=DADOS PESSOAIS PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS PESSOAIS PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc& =1739290047295. The manipulation leads to sql injection. The attack may be launched remotely.

A critical issue has been identified in Benner ModernaNet, affecting unknown code in the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the `fooId` argument leads to improper control of resource identifiers, allowing remote attacks. Upgrading to version 1.1.1 can address this issue.