9774 matches found
PHPSHE SQL Injection Vulnerability
PHPSHE is an online shopping mall system. The system supports express tracking, online chat, order evaluation and statistics. A SQL injection vulnerability exists in the admin.php?mod=user&act=del script in PHPSHE version 1.7. A remote attacker can exploit this vulnerability to execute arbitrary...
CVE-2018-18427
s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...
SQL Injection Vulnerability in Dscms
Dscms is an enterprise website builder based on TP5.0 framework development, using PHP + Mysql architecture. Dscms 0.1 version of the front-end SQL injection vulnerability, the vulnerability stems from the failure to filter the parameter $id, attackers can use the vulnerability to obtain sensitiv...
CVE-2018-17377
SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter...
CVE-2018-17375
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter...
CVE-2018-17375
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter...
Sql injection
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter...
PT-2018-13998
Name of the Vulnerable Software and Affected Versions Joomla! Music Collection version 3.0.3 Description A SQL Injection issue exists in the Music Collection component for Joomla!, which can be exploited via the id parameter. Recommendations For version 3.0.3, consider restricting access to the...
CVE-2018-17375: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter...
Quest KACE Systems Management run_report SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Quest KACE Systems Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the ID parameter provided to the runreport page...
CVE-2018-16970
Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to download non-purchased course files via a modified id parameter...
CVE-2018-16971
Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to access non-purchased course contents quiz / test via a modified id parameter...
CVE-2018-16970: Insertion of Sensitive Information into Externally-Accessible File or Directory
Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to download non-purchased course files via a modified id parameter...
PT-2018-13805
Name of the Vulnerable Software and Affected Versions Wisetail Learning Ecosystem LE versions through 4.11.6 Description The issue allows for insecure direct object reference IDOR attacks, enabling access to non-purchased course contents, such as quizzes or tests, by modifying the id parameter...
PT-2018-13804
Name of the Vulnerable Software and Affected Versions Wisetail Learning Ecosystem LE versions through 4.11.6 Description The issue allows for insecure direct object reference IDOR attacks, enabling the download of non-purchased course files. This is achieved by modifying the id parameter in a...
CVE-2018-16971: Authorization Bypass Through User-Controlled Key
Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to access non-purchased course contents quiz / test via a modified id parameter...
CVE-2018-16725
An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."...
CVE-2018-16725: Improper Neutralization of Input During Web Page Generation
An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."...
PT-2018-13702
Name of the Vulnerable Software and Affected Versions baijiacms version V4 Description A security issue exists in the software due to a Cross-Site Scripting XSS flaw. The vulnerability is exploited via the id parameter in the assets/weengine/components/zclip/ZeroClipboard.swf endpoint. This issue...