Sql injection

Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETESTR parameter...

Tongda2000 SQL注入漏洞

Tongda2000 is a web-based intelligent office system from Tongda, China. a SQL injection vulnerability exists in Tongda2000 v11.10, which stems from the product's failure to effectively filter the special characters in the DELETESTR parameter of the delete.php file. An attacker could use this...

CVE-2022-25404

Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETESTR parameter...

CVE-2022-25404

CVE-2022-25404 affects Tongda2000 v11.10, with a SQL injection in delete.php via the DELETE_STR parameter caused by insufficient input filtering. The issue is documented across multiple sources (CNVD/CNNVD/NVD Red Hat etc.) confirming an injectable SQL pathway in that specific version and file. N...

PT-2022-17267

Name of the Vulnerable Software and Affected Versions Tongda2000 version 11.10 Description A SQL injection issue was found in delete.php via the DELETE STR parameter. This allows for potential manipulation of database queries. Recommendations For Tongda2000 version 11.10, as a temporary workaroun...

CVE-2022-25404: Improper Neutralization of Special Elements used in an SQL Command

Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETESTR parameter...

PT-2021-23754

Name of the Vulnerable Software and Affected Versions ProjectWorlds Online Book Store PHP version 1.0 Description A CSRF issue in the admin delete.php file allows a remote attacker to delete any book. Recommendations For ProjectWorlds Online Book Store PHP version 1.0, consider implementing prope...

PT-2021-10283

Name of the Vulnerable Software and Affected Versions: Online Book Store version 1.0 Description: The issue allows a remote malicious user to execute arbitrary code via SQL Injection in the bookisbn parameter to the "admin delete.php" API endpoint. This could potentially lead to unauthorized acce...

PT-2020-20404

Name of the Vulnerable Software and Affected Versions MantisBT Source Integration plugin versions prior to 1.6.2 MantisBT Source Integration plugin versions 2.x prior to 2.3.1 Description A cross-site scripting XSS issue was found, allowing the execution of arbitrary code via a repo name on the...

PT-2019-7916

Name of the Vulnerable Software and Affected Versions Metinfo version 5.3.18 Description The issue allows for Information Disclosure through a remote attack vector. It involves a Cross Site Request Forgery CSRF attack, where the administrator clicks on a malicious link while in a logged-in state...

CVE-2017-12789: Cross-Site Request Forgery (CSRF)

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2018-17996

LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...

CVE-2018-17996: Cross-Site Request Forgery (CSRF)

LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...

PT-2019-9540

Name of the Vulnerable Software and Affected Versions LayerBB versions prior to 1.1.3 Description The issue allows for Cross-Site Request Forgery CSRF attacks, which can be used to perform unauthorized actions such as adding a user via "admin/new user.php", deleting a user via...

CVE-2017-1002005

Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contactid variable before adding it to the end of an SQL query...

CVE-2017-1002005: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contactid variable before adding it to the end of an SQL query...

PT-2017-10994

Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of input sanitization in the DTracker plugin. Specifically, user input via the contact id variable is not properly sanitized before being added to an SQL query in the...

PT-2017-17391

Name of the Vulnerable Software and Affected Versions MetInfo version 5.3.15 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the name 2 parameter to "admin/column/delete.php" API endpoint. Recommendations For MetInfo versio...

CVE-2017-6878: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name2 parameter to admin/column/delete.php...

UBUNTU-CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...