Sql injection

An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database via SQL injection...

CVE-2019-13447

An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database via SQL injection...

CVE-2019-4012

IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 155886...

Race condition

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=?php and admin/databack/bakuptables.php?2=fileputcontents URIs because...

Metinfo Competitive Conditions Vulnerability

MetInfo is a content management system CMS developed by China Mito MetInfo using PHP and Mysql. A competitive condition vulnerability exists in MetInfo. An attacker can exploit this vulnerability by means of a competitive condition in the backend database backup function via admin / index.php?n =...

Battelle V2I Hub SQL Injection Vulnerability

The Battelle V2I Hub is a connected vehicle and roadway information management system from Battelle Memorial Institute, Inc. The system supports effective communication between infrastructure information and vehicle information. A SQL injection vulnerability exists in Battelle V2I Hub version...

CVE-2018-1000631

Battelle V2I Hub 3.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tmx/TmxCtl/src/lib/PluginStatus.cpp and TmxControl::userinfo function, which could allow the attacker to view, add, modify or delete information in the back-end database...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs...

SaltOS SQL Injection Vulnerability

SaltOS is a suite of enterprise management solutions from the SaltOS program. The product integrates features such as CRM Customer Relationship Management and ERP Enterprise Resource Planning. A SQL injection vulnerability exists in SaltOS version 3.1 r8126, which can be exploited by remote...

Library Management System SQL Injection Vulnerability

Library Management System is a library management system. A SQL injection vulnerability exists in Library Management System version 1.0. A remote attacker can use the 'Search for Books' page to view, add, modify, or delete information in the back-end database...

Bakeshop Inventory System SQL Injection Vulnerability

Bakeshop Inventory System is a bakery inventory management system. A SQL injection vulnerability exists in Bakeshop Inventory System version 1.0. A remote attacker can use the login page to view, add, modify, or delete information in the back-end database...

School Event Management System SQL Injection Vulnerability

School Event Management System is a school event management system. A SQL injection vulnerability exists in School Event Management System version 1.0, which can be exploited by remote attackers to view, add, modify or delete information in the back-end database by sending the 'id' parameter to t...

Arbitrary File Deletion Vulnerability in HDWiki System Backend Database

Interactive Wiki open source system HDwiki is a free wiki Wiki building system. There is an arbitrary file deletion vulnerability in the backend database of the HDWiki system. An attacker can exploit the vulnerability to delete arbitrary files...

REDAXO SQL Injection Vulnerability (CNVD-2019-18492)

REDAXO is an open source Web portal content management system . The system supports custom modules , plug-in extensions , project backup and so on. REDAXO 5.6.3 before the version of the core/lib/list.php file 'prepareQuery' function there is a SQL injection vulnerability , a remote attacker can...

CVE-2018-1819

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end databas...

Frappe ERPNext SQL Injection Vulnerability

Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in the 'sortby' paramete...

Arbitrary File Deletion Vulnerability in PHPMyWind Backend Database Management System

PHPMyWind is a PHP+MySQL based, W3C compliant website building engine for enterprise level website building. An arbitrary file deletion vulnerability exists in the PHPMyWind backend database management. An attacker can exploit the vulnerability to delete arbitrary files...