CVE-2018-16361

An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter...

PT-2018-13516

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description An issue was discovered that allows XSS via the id parameter in the "news.php" endpoint. Recommendations For BTITeam XBTIT version 2.5.4, consider restricting access to the id parameter in the "news.php"...

CVE-2018-16361: Improper Neutralization of Input During Web Page Generation

An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter...

CVE-2018-16159

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request...

CVE-2014-6049

phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter...

Authorization

phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter...

OpenEMR SQL Injection Vulnerability (CNVD-2018-17198)

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A SQL injection vulnerability exists in the...

CVE-2018-15147

SQL injection vulnerability in interface/formsadmin/formsadmin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter...

CVE-2018-15147: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in interface/formsadmin/formsadmin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter...

PT-2018-12901

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the id parameter in the interface/forms admin/forms admin.php file, which is affected by the...

(0Day) Wecon LeviStudioU UserManage ID Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Wecon LeviStudioU. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling o...

FTP2FTP 1.0 - Arbitrary File Download

FTP2FTP 1.0 - Arbitrary File Download Exploit Title: FTP2FTP 1.0 - Arbitrary File Download Dork: N/A Date: 18.07.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395 Version: 1.0 Category: Webapps...

CVE-2018-13860

MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obtain sensitive information via the "/xml/menu/getObjectEditor.xml" URL, using a "?oid=systemSetup&id=0" or "?oid=systemUsers&id=0" GET...

UBUNTU-CVE-2018-13448

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the countryid parameter...

CVE-2018-13448

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the countryid parameter...

CVE-2018-7765

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter...

PT-2018-18266

Name of the Vulnerable Software and Affected Versions: Schneider Electric U.motion Builder versions prior to 1.3.4 Description: The issue exists in the processing of xmlserver.php, where the underlying SQLite database query is subject to SQL injection on the id input parameter. Recommendations: F...

CVE-2018-7769: Improper Neutralization of Special Elements used in an SQL Command

The vulnerability exists within processing of xmlserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the id input parameter...

CVE-2018-7766: Improper Neutralization of Special Elements used in an SQL Command

The vulnerability exists within processing of trackgetdata.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the id input parameter...

NEWMARK NMCMS SQL Injection Vulnerability

NEWMARK a.k.a. New Mark NMCMS is a content management system for corporate websites from the Russian company NEWMARK. A SQL injection vulnerability exists in NEWMARK NMCMS version 2.1. A remote attacker can exploit the vulnerability by sending the 'sectid' parameter to the /catalog URI to execute...