13506 matches found
PT-2019-13981
Name of the Vulnerable Software and Affected Versions Artica Integria IMS version 5.0.86 Description The issue allows for arbitrary file upload through the filemgr.php script in the wiki operation section. This is achieved by accessing the "index.php?sec=wiki&sec2=operation/wiki/wiki&action=uploa...
CVE-2019-14968
An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action...
CVE-2019-14968
An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action...
Sql injection
An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action...
CVE-2019-14968
An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action...
CVE-2019-14968
An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action...
PT-2019-13902
Name of the Vulnerable Software and Affected Versions imcat version 4.9 Description An issue was discovered that allows SQL Injection via the "order" parameter in the "index.php" endpoint, specifically when the "mod" parameter is set to "faqs". Recommendations For imcat version 4.9, consider...
CVE-2019-14968: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action...
Sql injection
Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter...
CVE-2019-14754
Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter...
Open-School 3.0 / Community Edition 2.3 Cross Site Scripting
Exploit Title: title Date: 2019 08 06 Exploit Author: Greg.Priest Vendor Homepage: https://open-school.org/ Software Link: Version: Open-School 3.0/Community Edition 2.3 Tested on: Windows/Linux CVE : CVE-2019-14696 Open-School 3.0, and Community Edition 2.3, allows XSS via the...
PT-2019-13818
Name of the Vulnerable Software and Affected Versions Open-School version 3.0 Community Edition version 2.3 Description The issue allows SQL Injection via the "index.php?r=students/students/document" endpoint, specifically the id parameter. Recommendations For Open-School version 3.0, update to a...
CVE-2019-14754: Improper Neutralization of Special Elements used in an SQL Command
Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter...
PT-2019-13790
Name of the Vulnerable Software and Affected Versions Open-School version 3.0 Community Edition version 2.3 Description The issue allows for XSS via the "osv/index.php?r=students/guardians/create" API endpoint, specifically through the id parameter. Recommendations For Open-School version 3.0,...
CVE-2019-14696: Improper Neutralization of Input During Web Page Generation
Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter...
Default credentials
Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATHINFO...
PT-2019-13716
Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.7-2 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the "app/index.php/zurmo/default" API endpoint, specifically through the PATH INFO. Recommendation...
CVE-2019-14472: Improper Neutralization of Input During Web Page Generation
Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATHINFO...
PT-2019-13571
Name of the Vulnerable Software and Affected Versions OpenSNS version 6.1.0 Description The issue allows SQL Injection via the "index.php?s=/ucenter/Config/" endpoint, specifically through the uid parameter. This is due to the getNeedQueryData function in...
CVE-2019-14266: Improper Neutralization of Special Elements used in an SQL Command
OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...