PT-2015-5647

Name of the Vulnerable Software and Affected Versions ZeusCart version 4 Description The issue concerns SQL injection vulnerabilities in the administrative backend. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. This can be achieved through the id parameter i...

CVE-2015-1450

SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php...

PT-2015-5292

Name of the Vulnerable Software and Affected Versions Restaurant Biller affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the cid parameter in a category action to "index.php". Recommendations At the moment, there...

CVE-2015-1450: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php...

CVE-2014-10015: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter...

PT-2015-3659

Name of the Vulnerable Software and Affected Versions PHPJabbers Event Booking Calendar version 2.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the cid parameter in the "load-calendar.php" file. Recommendations For PHPJabbers Event Booking...

PHPAPP注入第九枚（insert无视过滤）

简要描述： PHPAPP注入第九枚（insert无视过滤） 详细说明： 在wooyun上看到了有人提了PHPAPP的漏洞： http://wooyun.org/bugs/wooyun-2010-055604，然后去官网看了看，前几天刚有更新，就在官网下了PHPAPP最新的v2.6来看看2014-12-11更新的。 PSOT注入点：wwww.xxx.com/member.php?action=1&app=43&cid=2&rid=-1, 存在漏洞的文件在/phpapp/apps/refund/memberphpapp.php...

PT-2016-3506

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.5.4 Description The issue is related to several functions in FreeType, including t1 parse font matrix, cid parse font matrix, t42 parse font matrix, and ps parser load field, which do not check return values. This...

PT-2014-7885

Name of the Vulnerable Software and Affected Versions Springshare LibCal version 2.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the m or cid parameters in the "api...

CVE-2014-7291: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in apievents.php in Springshare LibCal 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 m or 2 cid parameter...

博文非书资料管理系统SQL注入漏洞

简要描述： 详细说明： 厂商：http://www.metadata.com.cn/ 杭州麦达电子有限公司版权所有 产品：博文非书资料管理系统 Google收录： /poweb/videoindex.do?status=vaffshow&cid= 注入参数cid and 1=1 返回正常 and 1=2 返回空白 漏洞证明： 【免责声明：以下为漏洞报告非利用方式，仅供证明漏洞未获取任何有效数据，案例仅供国家互联网应急中心测试使用，其它人不可利用漏洞进行恶意破坏，否则后果自负，漏洞在厂商确认后均做打码处理，感谢您的支持与理解！】 五个实例：...

CVE-2014-6028

TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookies action to profile.php...

CVE-2014-6028

TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookies action to profile.php...

CVE-2014-6029

CVE-2014-6029 affects TorrentFlux 2.4. The vulnerability arises in the editCookies action to profile.php, where the cid parameter allows remote authenticated users to delete or modify other users’ cookies. Reported impact includes partial integrity risk of cookies; confidentiality/availability im...

CVE-2014-6029

TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an editCookies action to profile.php...

PT-2014-7011

Name of the Vulnerable Software and Affected Versions TorrentFlux version 2.4 Description The issue allows remote authenticated users to obtain other users' cookies via the cid parameter in an "editCookies action" to "profile.php". Recommendations For TorrentFlux version 2.4, consider restricting...

CLONEBID B2B Marketplace Multiple Vulnerabilities

No description provided by source. / Name : CLONEBID B2B Marketplace Vendor : http://www.clonebid.com Author : Hamza 'MizoZ' N. Email : mizozxatgmaildotcom Greetz : Zuka ! / SQL Injection : File : selloffers.php , Get : cid HOST/PATH/selloffers.php?cid=INJECTION Demo :...

Concrete5 5.6.2.1 (index.php, cID param) - SQL Injection

No description provided by source. Exploit Title: Concrete5 sql injection Date: 18/02/2014 Exploit Author: [email protected] Vendor Homepage: https://www.concrete5.org/ Software Link: http://www.concrete5.org/downloadfile/-/view/58379/8497/ Version: 5.6.2.1 stable Tested on: Virtualbox debian UR...

phpBazar <= 2.1.1fix (cid) SQL Injection

No description provided by source. / Author : MizoZ from MA Group : EvilWay, evilwayatmaildotcom Email : mizozxatgmaildotcom Greetz : Zuka, Dyle !! MABROOK L3IIIIIIIIIID / The vulnerability is in the $GET'catid' , exploit :...

eXV2 Module bamaGalerie 3.03 - Remote SQL Injection Vulnerability

No description provided by source. eXV2 Module bamaGalerie 3.03 SQL Injection download=http://www.exv2-filecenter.de/modules/mydownloads/singlefile.php?lid=9 AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAİL : [email protected] DORKS 1 : allinurl :modules/bamagalerie3...