CVE-2017-13137

The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php...

CVE-2017-12977

The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwgedittag in photo-gallery.php and edittag in admin/controllers/BWGControllerTagsbwg.php. It is exploitable by administrators via the tagid parameter...

SQL Injection Vulnerability in Brand_id Parameter of PHPSHE B2C Mall System

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. A SQL injection vulnerability exists in the brandi...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-15545)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the /application/lib/ajax/getimage.php file in FineCMS 2017-07-12 and earlier versions. A remote attacker can exploit the vulnerability to inject...

SQL injection vulnerability in cms company.asp file id parameter

Tianjin Qihang enterprise station building cms is a website building system. SQL injection vulnerability exists in the id parameter of the company.asp file. An attacker can use this vulnerability to obtain sensitive information from the database...

CVE-2017-10667

In index.php in Zen Cart 1.6.0, the productsid parameter can cause XSS...

SQL Injection Vulnerability in add_address Method of ShopSn V2.0 Mall System

ShopsN Mall system is a product of Shanghai Yiso Network Technology Co., Ltd, an enterprise-class commercial standard full-featured allow free commercial use of open source online store full network system. A SQL injection vulnerability exists in the userid parameter in the addaddress method of t...

Schneider Electric U.motion Builder xmlserver Remote Code Execution Vulnerability

U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in Schneider Electric U.motion Builder xmlserver. The underlying SQLite database query requires SQL injection of the id input parameter. A remote attacker can exploit this...

SQL Injection Vulnerability in WinCMS id Parameter of Enterprise Business Technology

WinCMS is a website management system managed and developed by Tianjin Qishang Huichuang Technology Co. A SQL injection vulnerability exists in the WinCMS id parameter. The vulnerability allows attackers to exploit the vulnerability to obtain sensitive information in the database...

SQL Injection Vulnerability in 'menu_id' Parameter of Pioneer Hi-Tech Government System

Pioneer Hi-Tech Government System is an "easy technology" system. A SQL injection vulnerability exists in the 'menuid' parameter of the Pilot Hi-Tech Government System. This vulnerability can be exploited by attackers to obtain sensitive information from the database...

Cross-Site Scripting Vulnerability in C8OA System ID Parameter

C8OA system is a cooperative office system of Anhui XED Software Technology Co. There is a cross-site scripting vulnerability in the ID parameter of the C8OA system that allows an attacker to insert malicious js code into the page to obtain information such as user cookies, leading to user...

Qibo CMS whole site system V7.0 exists overstepping access vulnerability

Zibo CMS system is an open source content management system. Qibo CMS whole site system V7.0 suffers from an override access vulnerability. By modifying the UID parameter value, the attacker can traverse the sensitive information of other users, constituting information leakage...

The vulnerability of the Android operating system, which allows a hacker to trigger a service failure

The vulnerability of QMI QOS TLVs in the Android operating system arises due to buffer overflow. Exploiting this vulnerability allows a malicious actor to cause service failures by using a specially crafted directory name, specified in the uid parameter associated with the WAR file name contained...

My Php Dating 'id' Parameter SQL Injection Vulnerability

My Php Dating 2.0 is an online dating site system. The My Php Dating 'id' parameter SQL injection vulnerability can be exploited by attackers to access or modify database data...

EasyNetSites 'links.php' Page SQL Injection Vulnerability

EasyNetSites is a WEB-based tool for managing organizational relationships on websites. A SQL injection vulnerability exists in the cid parameter of the links.php page of EasyNetSites, which originates from the program's failure to adequately filter user-submitted input, and can be exploited by a...

SQL Injection and Arbitrary File Read Vulnerabilities in vlcms_v1.2 Latest Version

vlcms Xigu software team based on the OneThink framework to develop a solution to the promotion of handicraft management system. vlcms page media parameter $giftid and parameter $gameid are SQL injection vulnerability, attackers can obtain database information through the loophole, constituting...

SQL Injection Vulnerability in NetDoit of Acuity Brands Creative Marketing Ltd.

NetDoit is a small CMS system developed by php+mysql. The product newsdetail.php?id= exists SQL injection vulnerability, the injection parameter is id, the attacker can use the vulnerability to obtain database sensitive information...

SQL Injection Vulnerability in id Parameter of Penta Digital Campus System

Penta Digital Campus System is using the technology platform of .NET+SqlServer. SQL injection vulnerability exists in the /BG/ToDo/ToDoDetail.aspx and /BG/Txl/TxlDetail.aspx pages of the Pangda Digital Campus System. The lack of filtering of the 'id' parameter allows an attacker to exploit the...

SQL Injection Vulnerability in type=Detail&FileId Parameter of Penta Digital Campus System

Penta Digital Campus System is using the technology platform of .NET+SqlServer. A SQL injection vulnerability exists in the /BG/GRBG/FileManage/FileUPload.aspx page of Pangda Digital Campus System. The lack of filtering of the 'id' parameter allows an attacker to exploit the vulnerability to obta...

Streamo Online Radio And TV Streaming CMS SQL Injection Vulnerability

Streamo Online Radio And TV Streaming CMS is a popular online radio and TV streaming content management system. A SQL injection vulnerability exists in the id parameter of the programs.php page of Streamo Online Radio And TV Streaming CMS, which can be exploited by an attacker to take control of...