CGI Generic SQL Injection (Parameters Names)

By providing specially crafted parameters to CGIs, Nessus was able to get an error from the underlying database. This error suggests that the CGI is affected by a SQL injection vulnerability. An attacker may be able to exploit this flaw to bypass authentication, read confidential data, modify the...

Joomla! Component com_clan_members - 'id' SQL Injection

source: https://www.securityfocus.com/bid/46080/info The 'comclanmembers' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

CVE-2011-0009

Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database...

PHP Coupon Script <= 6.0 SQLi Vulnerability - Active Check

PHP Coupon Script is prone to an SQL injection SQLi vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PHPAuctions - viewfaqs.php SQL Injection

PHPAuctions - viewfaqs.php SQL Injection source: https://www.securityfocus.com/bid/45928/info PHPAuctions is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker...

Multiple Vulnerabilities in Redaxscript

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Redaxscript which could be exploited to perform SQL injection attacks and gain access to sensitive information. 1 SQL injection vulnerabilities in Redaxscript The vulnerability exists due to input sanitation erro...

Advanced Webhost Billing System (AWBS) 2.9.2 - 'oid' SQL Injection

source: https://www.securityfocus.com/bid/45827/info Advanced Webhost Billing System AWBS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. A successful exploit may allow an attacker to compromise the application, access or modify data, or...

Lifetype 1.2.10 HTTP Referer Cross Site Scripting

Exploit Title: lifetype 1.2.10 http referer XSSstored Date: 11-1-2010 Author: Saif El-Sherei Software Link: http://lifetype.net/page/downloads Version: 1.2.10 Tested on: firefox 3.0.15 failure to sanitize the http referer header in index.php results in a cross site scripting attack against admins...

CMS Tovar - 'tovar.php' SQL Injection

source: https://www.securityfocus.com/bid/45772/info CMS Tovar is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...

OpenEMR <= 3.2.0 Multiple Input Validation Vulnerabilities

OpenEMR is prone to SQL injection SQLi, HTML injection, and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PHP-AddressBook 6.2.4 - group.php SQL Injection

PHP-AddressBook 6.2.4 - group.php SQL Injection Exploit Title : PHP-AddressBook v6.2.4 SQL INJECTION VULNERABILITIES Script : PHP-AddressBook v6.2.4 Language : PHP DESCRIPTION:Simple, web-based address & phone book, contact manager, organizer. Groups, addresses, e-Mails, phone numbers & birthdays...

MyBB 1.6 - private.php?keywords SQL Injection

MyBB 1.6 - private.php?keywords SQL Injection source: https://www.securityfocus.com/bid/45565/info MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker ...

MyBB 1.6 - search.php?keywords SQL Injection

MyBB 1.6 - search.php?keywords SQL Injection source: https://www.securityfocus.com/bid/45565/info MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker t...

Joomla! Component Classified - SQL Injection

Joomla! Component Classified - SQL Injection source: https://www.securityfocus.com/bid/45545/info The Classified component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue cou...

Hycus CMS - Multiple Vulnerabilities

Hycus CMS - Multiple Vulnerabilities Vulnerability ID: HTB22737 Reference: http://www.htbridge.ch/advisory/lfiinhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: LFI Status:...

Social Share - Username SQL Injection

Social Share - Username SQL Injection source: https://www.securityfocus.com/bid/45536/info Social Share is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker t...

Social Share - postid SQL Injection

Social Share - postid SQL Injection source: https://www.securityfocus.com/bid/45497/info Social Share is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...

Joomla! Component JExtensions Property Finder - 'sf_id' SQL Injection

source: https://www.securityfocus.com/bid/45333/info JExtensions Property Finder is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application,...

Techno Dreams Articles Papers Package 2.0 - ArticlesTablelist.asp SQL Injection

Techno Dreams Articles Papers Package 2.0 - ArticlesTablelist.asp SQL Injection source: https://www.securityfocus.com/bid/45201/info Techno Dreams Articles & Papers Package is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in a...

CVE-2010-4329

Cross-site scripting XSS vulnerability in the PMAlinkOrButton function in libraries/common.lib.php in the database db search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request...