CVE-2017-15979

Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter...

CVE-2017-15980

US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter...

ZeeBuddy SQL Injection Vulnerability

ZeeBuddy is a social networking system based on PHP and MySQL. A SQL injection vulnerability exists in ZeeBuddy version 2x. A remote attacker can exploit this vulnerability by sending the 'groupid' parameter to the admin/editadgroup.php file to inject SQL commands to access or modify database dat...

VulnCheck KEV: CVE-2017-15919

The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php...

E-Sic Software livre CMS 'q' Parameter SQL Injection Vulnerability

E-Sic is a Brazilian electronic system for citizen information. A SQL injection vulnerability exists in E-Sic version 1.0. A remote attacker can exploit the vulnerability by sending the 'q' parameter to the file esiclivre/restrito/inc/lkpcep.php to execute arbitrary SQL commands...

WordPress Store Locator Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . Store Locator plugin is one of the store locator plugin . A SQL injection vulnerability exists in WordPress Sto...

Issuetracker phpBugTracker SQL Injection Vulnerability

Issuetracker phpBugTracker is a web-based defect tracking system. The system provides features such as project management and defect tracking services. A SQL injection vulnerability exists in Issuetracker phpBugTracker before 1.7.0. The vulnerability can be exploited by remote attackers to execut...

SQL Injection Vulnerability in Zhangjiakou Extraordinary Technology Website Building System

Zhangjiakou Extraordinary Technology Co., Ltd Extraordinary Technology for short, is an Internet service provider in the field of enterprise informationization construction and application services. Zhangjiakou Extraordinary Technology website building system has a SQL injection vulnerability,...

SQL Injection Vulnerability in Multiple Methods of WKshop General Mall System

WK+shop is a mall system based on the technology of PHP+MySQL, developed using ThinkPHP5.0 framework, which combines the Witcott mission system with multiple mall systems. WK+shop General Mall System has SQL injection vulnerability in several methods, an authenticated attacker can construct a...

SQL Injection Vulnerability in IBOS Enterprise Collaboration Management Software CategoryController.php Page

IBOS Enterprise Collaboration Management Software is a PHP-based collaborative office management system. A SQL injection vulnerability exists in the CategoryController.php page of IBOS Enterprise Collaboration Management Software. An attacker is allowed to exploit the vulnerability to obtain...

SQL Injection Vulnerability in IBOS Enterprise Collaboration Management Software HomeController.php Page

IBOS Enterprise Collaboration Management Software is a PHP-based collaborative office management system. A SQL injection vulnerability exists in the IBOS Enterprise Collaboration Management Software HomeController.php page. An attacker is allowed to exploit the vulnerability to obtain sensitive...

CVE-2017-14758

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to SQL Injection: /xAdmin/html/cmdoclistviewuc.jsp, parameter: documentId. In order for this vulnerability to be exploited, an attacker must authenticat...

FileRun Remote SQL Injection Vulnerability

FileRun File Manager gives you access to your files anytime, anywhere with self-hosted secure cloud storage, file backups and sharing of photos, videos, documents and more. FileRun suffers from a remote SQL injection vulnerability that originates from the program's failure to validate the metafie...

CVE-2017-14507

Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 timeline parameter in contenttimelineclass.php; or the id parameter to 2 pages/contenttimelineedit.php or 3 pages/contenttimelineindex.php...

WordPress Mojoomla School Management System SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on PHP and MySQL servers.Mojoomla School Management System is one of the school management systems. A SQL injection vulnerability exists in WordPre...

Drupal 'Commerce Invoices' Module SQL Injection and Cross Site Scripting Vulnerabilities

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Ctools Chaos tool suite is one of the API modules used to improve the development experience. SQL injection and cross-site scripting vulnerabilities exist in the Drupal 'Commerce...

WordPress Mojoomla SMSmaster Multipurpose SMS Gateway SQL Injection Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on PHP and MySQL servers.Mojoomla SMSmaster Multipurpose SMS Gateway is one of the set of multipurpose SMS gateways. A SQL injection vulnerability...

The software of the remote monitoring system Advantech WebAccess is vulnerable due to insufficient protection of the SQL query structure during authentication. This vulnerability allows attackers to execute arbitrary SQL commands and modify web server settings, user accounts, and projects.

The vulnerability of Advantech WebAccess remote monitoring software exists due to insufficient protection of the SQL query structure during authentication injection of SQL code. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands and modify web server settings...

TecnoVISION DLX Spot Player4 SQL Injection Vulnerability

TecnoVISION DLX Spot Player4 is a control management software for LED video walls from TecnoVISION Australia. A SQL injection vulnerability exists in the admin interface of TecnoVISION DLX Spot Player4 versions 1.5.10 and later. A remote attacker can exploit this vulnerability by using a speciall...

WordPress SQL Injection Vulnerability (CNVD-2017-34851)

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress WPDB SQL injection vulnerability can be exploited by an attacker to execute arbitrary SQL commands due to...