deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30048
Published: 2022-05-11
Description: Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/mingSoft/MCMS/issues/I54VG0; https://gitee.com/mingSoft/MCMS/issues/I54VG0
CVE: CVE-2022-30057
Published: 2022-05-11
Description: Shopwind <=v3.4.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.yuque.com/docs/share/7a16a567-53ce-4350-b[PII_REDACTED]f2ffe; https://www.yuque.com/docs/share/7a16a567-53ce-4350-b[PII_REDACTED]f2ffe
CVE: CVE-2022-30058
Published: 2022-05-11
Description: Shopwind <=v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \backend\controllers\DbController.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.yuque.com/docs/share/0a4355fa-441f-4073-b[PII_REDACTED]251c5; https://www.yuque.com/docs/share/0a4355fa-441f-4073-b[PII_REDACTED]251c5
CVE: CVE-2022-30059
Published: 2022-05-11
Description: Shopwind <=v3.4.2 was discovered to contain a Arbitrary File Delete vulnerability via the neirong parameter at \backend\controllers\DbController.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.yuque.com/docs/share/a8385d36-8038-4fa2-b15b-48e104774d61; https://www.yuque.com/docs/share/a8385d36-8038-4fa2-b15b-48e104774d61
CVE: CVE-2022-30060
Published: 2022-05-11
Description: ftcms <=2.1 was discovered to be vulnerable to Arbitrary File Write via admin/controllers/tp.php
CVSS Score: 8.8 (HIGH)
References: https://www.yuque.com/docs/share/96dcc866-822e-4ea4-aafb-5a89a6d4412e; https://www.yuque.com/docs/share/96dcc866-822e-4ea4-aafb-5a89a6d4412e
CVE: CVE-2022-30061
Published: 2022-05-11
Description: ftcms <=2.1 was discovered to be vulnerable to directory traversal attacks via the parameter tp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.yuque.com/docs/share/bb31a8e0-0f86-4edf-bdea-3b4e7162e344; https://www.yuque.com/docs/share/bb31a8e0-0f86-4edf-bdea-3b4e7162e344
CVE: CVE-2022-30062
Published: 2022-05-11
Description: ftcms <=2.1 was discovered to be vulnerable to Arbitrary File Read via tp.php
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.yuque.com/docs/share/713b23bf-2239-46de-9d1b-88b17d37dec3; https://www.yuque.com/docs/share/713b23bf-2239-46de-9d1b-88b17d37dec3
CVE: CVE-2022-30452
Published: 2022-05-11
Description: ShopWind <= v3.4.2 has a Sql injection vulnerability in Database.php
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.yuque.com/docs/share/a4391512-502b-48aa-a31b-a9297daa4f7d; https://www.yuque.com/docs/share/a4391512-502b-48aa-a31b-a9297daa4f7d
CVE: CVE-2022-30453
Published: 2022-05-11
Description: ShopWind <= 3.4.2 has a RCE vulnerability in Database.php
CVSS Score: 9.8 (CRITICAL)
References: https://www.yuque.com/docs/share/9a561b8c-734b-4ab5-b980-e794a457a2e5; https://www.yuque.com/docs/share/9a561b8c-734b-4ab5-b980-e794a457a2e5
CVE: CVE-2022-30063
Published: 2022-05-11
Description: ftcms <=2.1 was discovered to be vulnerable to code execution attacks .
CVSS Score: 9.8 (CRITICAL)
References: https://www.yuque.com/docs/share/78d43e01-2e4c-4a63-a305-6e688bef3e94; https://www.yuque.com/docs/share/78d43e01-2e4c-4a63-a305-6e688bef3e94
CVE: CVE-2022-30448
Published: 2022-05-11
Description: Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.yuque.com/docs/share/43407f5b-a831-4598-9648-5af9f780b12a; https://www.yuque.com/docs/share/43407f5b-a831-4598-9648-5af9f780b12a
CVE: CVE-2022-30449
Published: 2022-05-11
Description: Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in room.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.yuque.com/docs/share/8d4fd0f4-671f-4ed0-893d-af8227cddf84; https://www.yuque.com/docs/share/8d4fd0f4-671f-4ed0-893d-af8227cddf84
CVE: CVE-2022-30450
Published: 2022-05-11
Description: A Remote Code Execution (RCE) vulnerability exists in waimairen 9.1 via wx.php
CVSS Score: 9.8 (CRITICAL)
References: https://www.yuque.com/docs/share/5e8fa3c7-6fcd-492f-9d7c-bdf9052dca44; https://www.yuque.com/docs/share/5e8fa3c7-6fcd-492f-9d7c-bdf9052dca44
CVE: CVE-2022-30451
Published: 2022-05-11
Description: An authenticated user could execute code via a SQLi vulnerability in waimairenCMS before version 9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.yuque.com/docs/share/6a504753-caa2-4b5e-95a7-a3e5f9485e44; https://www.yuque.com/docs/share/6a504753-caa2-4b5e-95a7-a3e5f9485e44
CVE: CVE-2022-29596
Published: 2022-05-11
Description: MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=_any_password_&ConnMode=1&3054=Login substring for directory traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/haxpunk1337/Microstrategy-Poc/blob/main/poc; https://github.com/haxpunk1337/Microstrategy-Poc/blob/main/poc
CVE: CVE-2022-29855
Published: 2022-05-11
Description: Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
CVSS Score: 6.8 (MEDIUM)
References: http://packetstormsecurity.com/files/167547/Mitel-6800-6900-Series-SIP-Phones-Backdoor-Access.html; http://seclists.org/fulldisclosure/2022/Jun/32; https://www.mitel.com/support/security-advisories
CVE: CVE-2022-30557
Published: 2022-05-11
Description: Foxit PDF Reader and PDF Editor before 11.2.2 have a Type Confusion issue that causes a crash because of Unsigned32 mishandling during JavaScript execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-30592
Published: 2022-05-11
Description: liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/litespeedtech/lsquic/commit/a74702c630e108125e[PII_REDACTED]7baec8f02238#diff-73a138506faffe5f1efa8586346ab573c88e9dd2097774ecca5949a718a57cae; https://github.com/litespeedtech/lsquic/releases/tag/v3.1.0; https://github.com/litespeedtech/lsquic/commit/a74702c630e108125e[PII_REDACTED]7baec8f02238#diff-73a138506faffe5f1efa8586346ab573c88e9dd2097774ecca5949a718a57cae
CVE: CVE-2022-30594
Published: 2022-05-12
Description: The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html; http://packetstormsecurity.com/files/170362/Linux-PT_SUSPEND_SECCOMP-Permission-Bypass-Ptracer-Death-Race.html; https://bugs.chromium.org/p/project-zero/issues/detail?id=2276
CVE: CVE-2022-1044
Published: 2022-05-12
Description: Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://github.com/polonel/trudesk/commit/097b4823935c4fa524e71ab2dd107cf2056922b0; https://huntr.dev/bounties/ff878be9-563a-4d0e-99c1-fc3c767f6d3e; https://github.com/polonel/trudesk/commit/097b4823935c4fa524e71ab2dd107cf2056922b0
CVE: CVE-2022-1681
Published: 2022-05-12
Description: Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions
CVSS Score: 7.2 (HIGH)
CWE: CWE-288, CWE-287
References: https://github.com/requarks/wiki/commit/78d02dc8e5d103d248e5d7632bf7a6facdf4264c; https://huntr.dev/bounties/591b11e1-7504-4a96-99c6-08f2b419e767; https://github.com/requarks/wiki/commit/78d02dc8e5d103d248e5d7632bf7a6facdf4264c
CVE: CVE-2022-29885
Published: 2022-05-12
Description: The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html; https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv; https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
CVE: CVE-2022-1682
Published: 2022-05-12
Description: Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/neorazorx/facturascripts/commit/8e31d8434014a6d1e8791a489d84268fd74b0c9a; https://huntr.dev/bounties/e962d191-93e2-405e-a6af-b4a4e4d02527; https://github.com/neorazorx/facturascripts/commit/8e31d8434014a6d1e8791a489d84268fd74b0c9a
CVE: CVE-2022-29927
Published: 2022-05-12
Description: In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29928
Published: 2022-05-12
Description: In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29929
Published: 2022-05-12
Description: In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-29930
Published: 2022-05-12
Description: SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1.
CVSS Score: 8.7 (HIGH)
CWE: CWE-342, CWE-330
References: https://github.com/ktorio/ktor/pull/2966; https://www.jetbrains.com/privacy-security/issues-fixed/; https://github.com/ktorio/ktor/pull/2966
CVE: CVE-2022-1650
Published: 2022-05-12
Description: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-212, CWE-212
References: https://github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4; https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e; https://lists.debian.org/debian-lts-announce/2022/12/msg00021.html
CVE: CVE-2022-1674
Published: 2022-05-12
Description: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/a59f2dfd0cf9ee1a584d3de5b7c2d47648e79060
CVE: CVE-2022-28872
Published: 2022-05-12
Description: A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails in a loop.
CVSS Score: 4.3 (MEDIUM)
References: https://www.f-secure.com/en/home/support/security-advisories; https://www.f-secure.com/en/home/support/security-advisories
CVE: CVE-2022-28873
Published: 2022-05-12
Description: A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window.open functionality in SAFE Browser which could lead address bar spoofing attacks.
CVSS Score: 4.3 (MEDIUM)
References: https://www.f-secure.com/en/home/support/security-advisories; https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28873; https://www.f-secure.com/en/home/support/security-advisories
CVE: CVE-2021-42863
Published: 2022-05-12
Description: A buffer overflow in ecma_builtin_typedarray_prototype_filter() in JerryScript version fe3a5c0 allows an attacker to construct a fake object or a fake arraybuffer with unlimited size.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/jerryscript-project/jerryscript/issues/4793; https://github.com/jerryscript-project/jerryscript/pull/4794; https://github.com/jerryscript-project/jerryscript/issues/4793
CVE: CVE-2022-30525
Published: 2022-05-12
Description: A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html; http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html; http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html
CVE: CVE-2022-29538
Published: 2022-05-12
Description: RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. An unauthenticated user is able to access some critical resources.
CVSS Score: 5.3 (MEDIUM)
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoring; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-29539
Published: 2022-05-12
Description: resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. It does not properly check the parameters sent as input before they are processed on the server. Due to the lack of validation of user input, an unauthenticated attacker can bypass the syntax intended by the software (e.g., concatenate `&|;\r\ commands) and inject arbitrary system commands with the privileges of the application user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoring; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-29747
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/manage_invoice&id= // Leak place ---> id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-2.md
CVE: CVE-2022-29748
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via \cms\admin?page=client/manage_client&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-1.md
CVE: CVE-2022-29749
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_invoice.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-4.md
CVE: CVE-2022-29750
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-3.md
CVE: CVE-2022-29751
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_client.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-5.md
CVE: CVE-2022-29979
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_designation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-6.md
CVE: CVE-2022-29980
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=user/manage_user&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-7.md
CVE: CVE-2022-29981
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Users.php?f=delete.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-8.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-8.md
CVE: CVE-2022-29982
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/maintenance/manage_service.php?id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-9.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-9.md
CVE: CVE-2022-29983
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/view_invoice&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-10.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-10.md
CVE: CVE-2022-29984
Published: 2022-05-12
Description: Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=client/view_client&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-11.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/simple-client-management-system/SQLi-11.md
CVE: CVE-2022-29985
Published: 2022-05-12
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete_category.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-1.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-1.md
CVE: CVE-2022-29986
Published: 2022-05-12
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete_facility.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-2.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-2.md
CVE: CVE-2022-29987
Published: 2022-05-12
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=user/manage_user&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-5.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-5.md
CVE: CVE-2022-29988
Published: 2022-05-12
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-4.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-4.md
CVE: CVE-2022-29989
Published: 2022-05-12
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete_booking.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-3.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-3.md
CVE: CVE-2022-29990
Published: 2022-05-12
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/categories/view_category.php?id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-6.md
CVE: CVE-2022-29992
Published: 2022-05-12
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/categories/manage_category.php?id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQli-7.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQli-7.md
CVE: CVE-2022-29993
Published: 2022-05-12
Description: Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/bookings/view_booking.php?id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-8.md; https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-8.md