SQL injection in like-girl 5.2.0 allows remote authenticated attackers to execute arbitrary SQL commands via the /admin/ImgUpdaPost.php endpoint. Public exploit code is available, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.
Authenticated SQL injection in like-girl 5.2.0 via the /admin/ipAddPost.php endpoint allows remote attackers with administrative privileges to manipulate database queries. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV.
SQL injection in kiCode111 like-girl 5.2.0 allows authenticated administrators to execute arbitrary SQL queries via the imgDatd, imgText, or imgUrl parameters in /admin/ImgAddPost.php, leading to potential data theft or modification. Exploit code is publicly available; the vendor did not respond to early disclosure and no patch has been released.
SQL injection in like-girl 5.2.0 allows authenticated admin users to execute arbitrary SQL commands via the /admin/CopyadminPost.php endpoint. A public exploit exists, but no active exploitation has been confirmed. The vendor did not respond to disclosure, leaving the vulnerability unpatched.
SQL injection in kiCode111 like-girl 5.2.0 allows remote authenticated attackers to execute arbitrary SQL commands via multiple parameters in /admin/aboutPost.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.07%), indicating limited exploitation likelihood.
An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.