13520 matches found
Sql injection
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
CVE-2018-18075
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
CVE-2018-18075
WikidForum 2.20 is affected by an SQL Injection vulnerability exposed via the rpc.php (parent_post_id or num_records) parameters, or the index.php?action=search (select_sort) parameter. The issue, reported across multiple sources, indicates that unsafely constructed SQL queries can be influenced ...
PT-2018-14363
Name of the Vulnerable Software and Affected Versions qibosoft version 7.0 Description The issue allows for a CSRF attack, enabling an attacker to add a user account. This can be achieved through the "admin/index.php?lfj=member&action=addmember" API endpoint. Recommendations For qibosoft version...
PT-2018-14335
Name of the Vulnerable Software and Affected Versions WikidForum version 2.20 Description The issue concerns SQL Injection, which can be exploited through specific parameters in the software. The vulnerable parameters include parent post id and num records in the 'rpc.php' endpoint, as well as th...
CVE-2018-18075: Improper Neutralization of Special Elements used in an SQL Command
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
CVE-2018-18198: Improper Neutralization of Input During Web Page Generation
The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...
PT-2018-14360
Name of the Vulnerable Software and Affected Versions REDAXO version 5.6.3 Description The issue concerns the $opener input field variable in the addons/mediapool/pages/index.php file, which is not properly filtered and is directly output to the page. An attacker can exploit this by inserting XSS...
CVE-2018-18201: Cross-Site Request Forgery (CSRF)
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...
CVE-2012-6710
extfinduser in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password= aka an empty array in an action=login request to index.php...
CVE-2012-6710
The CVE-2012-6710 issue affects eXtplorer (through version 2.1.2). It allows remote attackers to bypass authentication by sending password[]= (an empty array) in an action=login request to index.php, enabling unauthorized access. Affected component is ext_find_user; root cause is authentication b...
CVE-2012-6710: Improper Authentication
extfinduser in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password= aka an empty array in an action=login request to index.php...
PT-2018-4062
Name of the Vulnerable Software and Affected Versions eXtplorer versions prior to 2.1.3 Description The issue allows remote attackers to bypass authentication. This can be achieved by sending an action=login request to "index.php" with a password variable set to an empty array. Recommendations Fo...
CVE-2018-17428
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...
CVE-2018-17428
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...
PT-2018-14024
Name of the Vulnerable Software and Affected Versions OPAC EasyWeb Five version 5.7 Description An issue was discovered that allows SQL injection via the "w2001/index.php?scelta=campi biblio" parameter. Recommendations For OPAC EasyWeb Five version 5.7, consider restricting access to the vulnerab...
CVE-2018-17428: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...
WUZHICMS 2.0 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in t...
CVE-2018-17830
The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...