CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-25399
https://notcve.org/view.php?id=CVE-2022-25399
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. Se ha detectado que Simple Real Estate Portal System versión v1.0, contiene una vulnerabilidad de inyección SQL por medio del parámetro id • https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Real-Estate-Portal-System • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 4CVE-2021-24750 – WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
https://notcve.org/view.php?id=CVE-2021-24750
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks El plugin WP Visitor Statistics (Real Time Traffic) de WordPress versiones anteriores a 4.8, no sanea y escapa correctamente de la refUrl en la acción refDetails AJAX, disponible para cualquier usuario autenticado, que podría permitir a usuarios con un rol tan bajo como el de suscriptor llevar a cabo ataques de inyección SQL WordPress WP Visitor Statistics plugin versions 4.7 and below suffer from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/50619 https://github.com/fimtow/CVE-2021-24750 http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html https://plugins.trac.wordpress.org/changeset/2622268 https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 7%CPEs: 1EXPL: 3CVE-2021-45043 – HD-Network Real-time Monitoring System 2.0 - Local File Inclusion (LFI)
https://notcve.org/view.php?id=CVE-2021-45043
HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter. HD-Network Real-time Monitoring System versión 2.0, permite un salto de directorio ../ para leer /etc/shadow por medio del parámetro /language/lang s_Language • https://www.exploit-db.com/exploits/50588 https://drive.google.com/file/d/1DlfZz0F8skWy3Mkahx_NMo-sYZh9-eun/view?usp=sharing https://drive.google.com/file/d/1bx9yCN-IHYuRpd7g3jhMb0LcTC1ARzSX/view?usp=sharing • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20336
https://notcve.org/view.php?id=CVE-2019-20336
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS. En PHP Scripts Mall advanced-real-estate-script versión 4.0.9, el parámetro searchtext del archivo search-results.php es vulnerable a un ataque de tipo XSS. • https://github.com/Mad-robot/CVE-List/blob/master/Advanced%20Real%20Estate%20Script.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20337
https://notcve.org/view.php?id=CVE-2019-20337
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection. En PHP Scripts Mall advanced-real-estate-script versión 4.0.9, el parámetro news_id del archivo news_edit.php es vulnerable a una inyección SQL. • https://github.com/Mad-robot/CVE-List/blob/master/Advanced%20Real%20Estate%20Script.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •