Desdev DedeCMS 跨站脚本漏洞

DedeCMS Dream Weaving Content Management System is a set of simple, robust, flexible, open source several characteristics of open source content management system. A cross-site scripting vulnerability exists in DedeCMS version 7.5 SP2, which can be exploited to inject malicious script code via th...

Desdev DedeCMS 跨站脚本漏洞

DedeCMS Dream Weaving Content Management System is a set of simple, robust, flexible, open source several characteristics of open source content management system. DedeCMS has a cross-site scripting vulnerability that can be exploited to inject malicious script code via the filename, mid, userid ...

CVE-2021-25932

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since t...

CVE-2019-7316

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

CVE-2019-7316

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...

Sql injection

Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the 1 email parameter or 2 userid parameter to register.php...

NexusPHP SQL Injection Vulnerability (CNVD-2017-220447)

NexusPHP is a resource sharing community solution written in PHP developed by the Nexus team in China. A SQL injection vulnerability exists in the modtask.php file in NexusPHP version 1.5. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the help of the...

Sql injection

SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter...

CVE-2017-12909

SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter...

Vulnerability in userid parameter of online customer service page of China Telecom's Palm Business Hall app.

China Telecom Pocket Business Office is a cell phone terminal-based application software that provides users with recharge and payment, cost inquiries and other services. The userid parameter in the online customer service page of China Telecom's Pocket Business Office app has an overstepping...

Joomla! Component Soccer Bet 4.1.5 - 'userid' SQL Injection

Exploit Title: Joomla! Component Soccer Bet 4.1.5 - 'userid' Parameter SQL Injection Google Dork: inurl:index.php?option=comsoccerbet Date: 12.02.2017 Vendor Homepage: http://www.jomsoccerbet.com/ Software Buy:...

SQL Injection Vulnerability in the userId Parameter of Hi-Read Media's Digital Newspaper System

Joyful Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. The product has a SQL injection vulnerability, the vulnerability URL is: index.php?mod=admin&con=subscribe&act=unsubscribe&subsId=31&userId=880&paperscn=%B8%D6%CC%FA%C2%AF%C1%CF&papersen=gtll, the...

Digital Campus 2.0 Platform数字校园平台 /Code/Common/UpdateOnLine.aspx 文件 UserID 参数 SQL注入漏洞

No description provided by source...

Mymps v5.0 /wap/index.php 参数userid存在SQL注入

No description provided by source...

JPORTAL资源整合SQL注射漏洞

简要描述： JPORTAL资源整合SQL注射漏洞 详细说明： 突然发现大汉网络的JPORTAL资源整合系统在一般应用里面，SO... 我来了 文件路径： /pertoolsubsite/read/favoajaxforgen.jsp 部分代码为： else if"DO".equalsopr if !type.equals"11"||url.trim.length==0||paperTitle.trim.length==0 out.clear; out.print"false"; return; ArrayList list =...

用友NC-IUFO系统通用SQL注入(三)

简要描述： ... 详细说明： 该系统“忘记密码”模块存在sql注入漏洞 链接地址为：/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234 说明：输入用户名和邮箱后提交，程序会提交给 /epp/core（可从抓取的数据包中看到）， 漏洞参数：userid 数据库系统：oracle 注入类型：AND/OR time-based blind 这里直接给出证明案例（列出数据库实例名称即可、不深入）： 0x01; http://nc.xhlbdc.com/epp/ POST /epp/core HTTP/1.1 Host: nc.xhlbdc.co...

Sql injection

Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the 1 sectionID parameter to admin/managersection.php, 2 userID parameter to admin/edituser.php, 3 username parameter to admin/admin.php, or 4 title parameter to...

OvBB 0.x profile.php userid Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15566/info OvBB is prone to multiple SQL injection vulnerabilities. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit...

PHP Gift Registry 1.5.5 - SQL Injection

No description provided by source. Exploit Title: PHP Gift Registry 1.5.5 SQL Injection Date: 02/22/12 Author: G13 Software Link: https://sourceforge.net/projects/phpgiftreg/ Version: 1.5.5 Category: webapps php Vulnerability The userid parameter in the users.php file is vulnerable to SQL...

Stack overflow

Stack-based buffer overflow in Easy File Sharing EFS Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp...