PT-2018-18243

Name of the Vulnerable Software and Affected Versions: YxtCMF version 3.1 Description: An issue exists in YxtCMF where SQL Injection is possible. This occurs in the ShitiController.class.php file through the ids array parameter in the "/exam/shiti/delshiti.html" API endpoint. Recommendations: For...

CVE-2018-7732: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in YxtCMF 3.1. SQL Injection exists in ShitiController.class.php via the ids array parameter to exam/shiti/delshiti.html...