CVE-2018-20329

Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue which may optionally be made public to extract and/or modify database information...

Critical SQLite Flaw Leaves Millions of Apps Vulnerable to Hackers

Cybersecurity researchers have discovered a critical vulnerability in widely used SQLite database software that exposes billions of deployments to hackers. Dubbed as 'Magellan ' by Tencent's Blade security team, the newly discovered SQLite flaw could allow remote attackers to execute arbitrary or...

SQL Injection Vulnerability in HuCart aj***.php Page

HuCart HuCart is an open source enterprise building system. HuCart 5.7.4 version aj.php page SQL injection vulnerability , remote attackers can exploit the vulnerability to obtain database sensitive information...

Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Dolibarr ERP/CRM = 8.0.3 - Cross-Site Scripting CVE: CVE-2018-19799 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://dolibarr.org Software Link:...

SQL Injection Vulnerability in CCTV Online Teaching Platform

CCTV Digital Resource Teaching Platform is a platform for flexible lesson preparation and convenient teaching created for schools by Nanjing 55th Technology Development Co. A SQL injection vulnerability exists in the CCTF Online Network Teaching Platform. An attacker can use this vulnerability to...

SQL Injection Vulnerability in se***.php Page of Tianmu MVC Web Management System

Tianmu MVC website management system is Pizhou Tianmu Network Technology Co., Ltd. developed a professional PHP + MYSQL products, the use of independent MVC framework, applicable to large and small and medium-sized enterprises of the open source MVC. Tianmu MVC website management system se.php pa...

CVE-2018-1802

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640...

CVE-2018-1781

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 could allow a local user to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148804...

SQL Injection Vulnerability in Th***.php file of PawnBuilder CMS Frontend

SmallBuild CMS is a website management backend based on the OneThink open source framework. There is a SQL injection vulnerability in the Th.php file in the frontend of PawnBuilder CMS. Attackers can use the vulnerability to obtain database sensitive information...

WebVet 0.1a - 'id' SQL Injection

Exploit Title: WebVet 0.1a - 'id' SQL Injection Dork: N/A Date: 2018-11-04 Exploit Author: Ihsan Sencan Vendor Homepage: http://webvet.exreality.net/ Software Link: https://netix.dl.sourceforge.net/project/webvet/webvet20130708.zip Version: 0.1a Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

SQL Injection Vulnerability in EnableQ Online Survey Engine Aj***.php File

EnableQ online survey engine is a universal online survey management platform developed by Beijing Covey Nengdang Information Technology Co. A SQL injection vulnerability exists in the Aj.php file of the EnableQ online survey engine. An attacker can exploit the vulnerability to obtain sensitive...

Unspecified Vulnerability in Oracle Database Server (CNVD-2018-24128)

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. A security vulnerability exists in the Text component of Oracle Database Server version...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2019-23148)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A denial of service vulnerability exists in the Server:Storage Engines component of Oracle MySQL Server. An attacker can exploit this vulnerability t...

SQL Injection Vulnerability in Hongting Financial CRM Customer Management Software

Hongting Financial CRM Customer Management Software is a sales management platform that provides the most advanced and comprehensive sales management solution for business users. A SQL injection vulnerability exists in Hanting Financial CRM Customer Management Software, which can be exploited by...

CVE-2018-1812

IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting, caused by missing escaping of a database field. An attacker that has access to the Control Room database could exploit this vulnerability to execute script in a victim's web...

CVE-2018-1812

IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting, caused by missing escaping of a database field. An attacker that has access to the Control Room database could exploit this vulnerability to execute script in a victim's web...

elephant.se XSS vulnerability

Open Bug Bounty ID: OBB-678847 Description| Value ---|--- Affected Website:| elephant.se Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-17092

Summary: DonLinkage 6.6.8 is affected by a SQL injection in the /pages/proxy/php.php and /pages/proxy/add.php endpoints. The vulnerability allows an attacker to obtain information from the database when input is specially crafted. The attack can only be triggered by an authorized user, per the di...

CVE-2018-17092

An issue was discovered in DonLinkage 6.6.8. SQL injection in /pages/proxy/php.php and /pages/proxy/add.php can be exploited via specially crafted input, allowing an attacker to obtain information from a database. The vulnerability can only be triggered by an authorized user...

SQL Injection

express-cart is vulnerable to SQL injection. A lack of user input sanitization in the login handlers allow attackers to inject MongoDB queries through the customer and admin login parameters. The vulnerability could be exploited to retrieve or modify arbitrary entries in the database...