CVE-2015-7348

Cross-site scripting XSS vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php...

CVE-2015-7348: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php...

PT-2015-7526

Name of the Vulnerable Software and Affected Versions zTree versions 3.5.19.1 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter to "demo/en/asyncData/getNodesForBigData.php" API endpoint. Recommendations Fo...

PT-2015-7533

Name of the Vulnerable Software and Affected Versions Open Flash Chart 2 Revive Adserver versions prior to 3.2.2 CA Release Automation versions prior to 5.0.2-227 CA Release Automation versions prior to 5.5.1-1616 CA Release Automation versions prior to 5.5.2-434 CA Release Automation versions...

GLPI Elevation of Privilege Vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A security vulnerability exists in GLPI 0.85.2 and earlier versions. The...

UBUNTU-CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

Web Reference Database XML Injection Vulnerability

Web Reference Database is a web-based multi-user interface product that provides search tools and automatic indexing for managing scientific literature. The Web Reference Database unapi.php script fails to adequately filter the 'id' parameter and the sru.php script fails to adequately filter the...

CVE-2015-5076

Multiple cross-site scripting XSS vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 version parameter in protected/views/admin/formEditor.php; the 2 importId parameter in protected/views/admin/rollbackImport.php; the 3 bc, 4 fg,...

Design/Logic Flaw

Web Reference Database aka refbase through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via 1 the id parameter to unapi.php or 2 the stylesheet parameter to sru.php...

CVE-2015-6011

CVE-2015-6011 affects the Web Reference Database (refbase) prior to 0.9.6 (and bleeding-edge builds before 2015-01-08). The vulnerability is an XML injection via the unapi.php id parameter or the sru.php stylesheet parameter. Technical detail across connected sources confirms this is an XML injec...

CVE-2015-7235: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in dexreservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in a dexreservationscalendarload2 action or 2 dexitem parameter in a...

SQL Injection Vulnerability in DeptId Parameter of Wave Software Administrative Services System

The Administrative Service System ASS is a comprehensive administrative service system that integrates information and consultation, approval and charging, management and coordination, and complaints and supervision. A SQL injection vulnerability exists in the DeptId parameter of the administrati...

SQL Injection Vulnerability in id Parameter of Wave Software Administrative Services System

The Administrative Service System ASS is a comprehensive administrative service system that integrates information and consultation, approval and charging, management and coordination, and complaints and supervision. A SQL injection vulnerability exists in the id parameter of the administrative...

Sql injection

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...

PT-2015-7397

Name of the Vulnerable Software and Affected Versions Synology Video Station versions prior to 1.5-0757 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to the "audiotrack.cgi" endpoint. Recommendations For versions prior to...

CVE-2015-6910: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi...

PT-2015-7398

Name of the Vulnerable Software and Affected Versions Synology Video Station versions prior to 1.5-0763 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to the "watchstatus.cgi" endpoint. Recommendations For versions prior to...

CVE-2015-6911: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi...

BlueLine Intelligent Collaboration Platform EIS File Containment Vulnerability

BlueLine Intelligent Collaboration Platform EIS is an oa system based on asp.net and SharePoint, which is widely used in various industries. An arbitrary file download vulnerability exists in EIS of BlueLine Intelligent Collaboration Platform. Because the Project/ProjectInfo/DownLoad.aspx page...

SQL Injection Vulnerability in Panmicro Collaborative Business System

Panavision Collaborative Business System is a complete enterprise collaborative work platform. A SQL injection vulnerability exists in the typename and id parameters of the Panmicro Collaborative Business System. It allows attackers to exploit the vulnerability to gain access to sensitive...