SQL injection vulnerability in the file cm***_li***_ed***.php in VANOC Enterprise Website Management System (PHP version)

Vanno enterprise website management system PHP version is a php+MySQL development of php enterprise website management system. A SQL injection vulnerability exists in the file cmlied.php in the VANOC enterprise website management system PHP version. An attacker can exploit the vulnerability to...

SQL injection vulnerability in Tpshop v3.5 Or***.php page (CNVD-2019-17507)

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the Tpshop v3.5 Or.php page. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Bo-blog Wind CMS ad***.mo***.php page suffers from SQL injection vulnerability

Bo-blog Wind BW for short is a lightweight personal blogging program. A SQL injection vulnerability exists in the Bo-blog Wind CMS ad.mo.php page. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL injection vulnerability in Tpshop v3.5 Ar***.php page (CNVD-2019-18764)

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the Tpshop v3.5 Ar.php page. Attackers can use the vulnerability to obtain sensitive information in the database...

SQL Injection Vulnerability in Tpshop Pr***.php Page at Active Order Deletion

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the deletion of active orders on the Tpshop Pr.php page. Attackers can use the vulnerability to obtain sensitive information in the database...

SQL Injection Vulnerability in Azeus CMS System 2.0

Azeus CMS is a free CMS system produced by Azeus Studio with comprehensive management features, easy-to-learn operation and high security. Azeus CMS System 2.0 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Carel pCOWeb < B1.2.1 - Cross-Site Scripting

Exploit Title: Carel pCOWeb - Stored XSS Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.carel.com/ Version: Carel pCOWeb all versions prior to B1.2.1 Tested on: It is a proprietary devices: http://www.carel.com/product/pcoweb-card 1. Description: In Carel pCOWeb web page...

Carel pCOWeb Cross Site Scripting / Credential Disclosure

Exploit Title: Carel pCOWeb - Stored XSS Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.carel.com/ Version: Carel pCOWeb all versions prior to B1.2.1 Tested on: It is a proprietary devices: http://www.carel.com/product/pcoweb-card 1. Description: In Carel pCOWeb web page...

CVE-2018-18800

The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...

CVE-2017-12761

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

CVE-2017-12757

Certain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business Networking Script 8.26i and Tech Caregiver Script 2.71i and Tech Classifieds Script 7.41i and Tech Dating Script 3.40i and Tech Freelancer Script 5.27i and Tech Image...

CVE-2017-12759

Ynet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection. The impact is: Code execution remote...

CVE-2017-12758

https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. The impact is: Code execution remote. The component is: comappointment component...

Suzhou Jushang Network Technology Co., Ltd. website building system has SQL injection vulnerabilities

Suzhou Jushang Network Technology Co., Ltd. is a business enterprise e-commerce solutions, website construction, domain name registration, web hosting, enterprise post office, software development, system integration, Baidu search bidding ranking promotion and other services. Suzhou Jushang Netwo...

SQL Injection Vulnerability in na***_ed***.php of Acme CMS Backend

Acme CMS is a full-featured, PHP + Mysql architecture, multi-language, responsive display, suitable for personal website construction CMS building system. There is a SQL injection vulnerability in the backend naed.php of Acme CMS, which can be exploited by attackers to obtain sensitive database...

python-sqlalchemy: SQL Injection when the group_by parameter can be controlled

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

doorGets SQL Injection Vulnerability

DoorGets is a free and open source content management system. A SQL injection vulnerability exists in /doorgets/app/requests/user/configurationRequest.php in doorGets 7.0 at action=network. A user with remote backend administrator privileges or a user with Manage Network Configuration privileges...

CVE-2019-11623

doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user or a user with permission to manage configuration siteweb could exploit the vulnerability to obtain database sensitive...

CVE-2019-11613

doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/contactView.php. A remote normal registered user could exploit the vulnerability to obtain database sensitive information...

doorGets SQL Injection Vulnerability (CNVD-2019-26506)

doorGets is a content management system CMS. The system supports multiple languages, and system backups and theme changes, etc. A SQL injection vulnerability exists in doorGets version 7.0, which can be exploited by attackers to execute illegal SQL commands...