CVE-2019-8425

includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...

CVE-2019-5886

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation...

CVE-2019-5886: Improper Locking

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation...

PT-2019-17844

Name of the Vulnerable Software and Affected Versions ShopXO version 1.2.0 Description An issue in the application allows an attacker to reinstall the database due to the lack of validation in the Add method of the Index.php file. This enables the attacker to write arbitrary code to database.php...

PT-2019-19027

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3 Description The issue concerns the construction of SQL error messages in the includes/database.php file, which is affected by a cross-site scripting XSS issue. Recommendations For versions prior to 1.32.3,...

CVE-2018-19433

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

Design/Logic Flaw

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

CVE-2018-19433

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

PT-2018-14959

Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.1 Description The issue arises from the mishandling of the $cur lang value in the install/database.php file, leading to a potential XSS attack via the lang parameter. Recommendations For ShowDoc version 2.4.1, avoid using t...

CVE-2018-19433: Improper Neutralization of Input During Web Page Generation

ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...

CVE-2018-19197: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths=../ directory traversal...

Code injection

statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...

CVE-2018-19180

statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...

CVE-2018-19180

statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...

PT-2018-14841

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by placing the code in the DB PREFIX field, which is then written to database.php, when the index.php?s=index/install/setup...

PT-2018-13573

Name of the Vulnerable Software and Affected Versions SeaCMS versions through 6.61 Description An issue in SeaCMS allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter in the 'adm1n/admin database.php' endpoint. This can lead to the product...

Sql injection

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

CVE-2018-12912

HongCMS 3.0.0 contains a SQL Injection vulnerability in admin/controllers/database.php, exploitable via the request admin/index.php/database/operate?dbaction=emptytable&tablename= (URI). Public exploit/activity references show an authenticated/remote-exploit path using this parameter to inject SQ...

CVE-2018-12912

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

CVE-2018-12912: Improper Neutralization of Special Elements used in an SQL Command

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...