CVE-2014-3119

Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 searchstring parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to ...

PT-2020-7643

Name of the Vulnerable Software and Affected Versions web2Project versions 3.1 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the search string parameter in the contacts module to "index.php" or by remote attackers v...

CVE-2014-3119: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 searchstring parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to ...

SugarCRM Contacts Module SQL Injection Vulnerability

SugarCRM is a set of open source customer relationship management software . A SQL injection vulnerability exists in the Contacts module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit this vulnerability to inject custom PHP code...

CVE-2019-17296

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user...

CVE-2019-17296

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user...

Sql injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user...

CVE-2019-17296

SugarCRM is vulnerable to SQL injection in the Contacts module on versions before 8.0.4 and 9.x before 9.0.2 due to input validation issues; a regular user can exploit it. The CVE notes these fixes in 8.0.4 and 9.0.2. No exploitation details are provided in the connected documents.

CVE-2019-17296: Improper Neutralization of Special Elements used in an SQL Command

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user...

PT-2019-15059

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the Contacts module by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later...

CVE-2018-8047

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

CVE-2018-1000547

coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result in The error allows you to access records that you have no permissions to...

CVE-2015-4349

CVE-2015-4349 affects the Drupal Spider Contacts module. It is a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to hijack administrator actions for requests that delete contact categories. The issue is tied to the Spider Contacts module (not Drupal core) and is mitigated...

嘉缘人才系统sql注入

简要描述： rt 详细说明： 看到看到frcms\inc\ contacts.php if$companyid!=0 if$hireid!=0 $db -query"update $cfg'tbpre'hire set hvisitcount=hvisitcount+1 where hid=$hireid and hcomid=$companyid"; $goto=$cfg'path'."co/hire.php?id=$hireid"; $rs = $db-getone"select...

Multiple SQL Injection Vulnerabilities in Drupal Spider Contacts Module

Drupal is an open source content management platform. Multiple SQL injection vulnerabilities exist in the Drupal Spider Contacts module, which could be exploited by attackers to compromise an application, access and modify data, or potentially exploit a vulnerability in the underlying database...

CVE-2012-3836

Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 groupname parameter in a savecategory in the users module; 2 virtualfilename, 3 branch, 4 contactperson, 5 street, 6 city, 7 province, 8 postal, 9...

CVE-2012-3836: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 groupname parameter in a savecategory in the users module; 2 virtualfilename, 3 branch, 4 contactperson, 5 street, 6 city, 7 province, 8 postal, 9...

CVE-2005-3822

Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username in the login form or 2 record parameter, as demonstrated in the EditView action for the Contacts module...

CVE-2005-3822

Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username in the login form or 2 record parameter, as demonstrated in the EditView action for the Contacts module...

CVE-2005-3822: Undefined Security Weakness

Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username in the login form or 2 record parameter, as demonstrated in the EditView action for the Contacts module...