CVE-2019-20896

WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter...

CVE-2019-20896: Improper Neutralization of Special Elements used in an SQL Command

WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter...

PT-2020-10859

Name of the Vulnerable Software and Affected Versions WebChess version 1.0 Description The issue allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter. Recommendations For WebChess version 1.0, as a temporary workaround, consider restricting access to the paramete...

Chamilo LMS IDOR - 'messageId' Delete POST Injection

Document Title: =============== Chamilo LMS IDOR - messageId Delete POST Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1720 Video: https://www.youtube.com/watch?v=3ApPhUIk12Y Release Date: ============= 2016-02-15 Vulnerability...

CVE-2014-8487: Exposure of Sensitive Information to an Unauthorized Actor

Kony Management aka Enterprise Mobile Management or EMM 1.2 and earlier allows remote authenticated users to read 1 arbitrary messages via the messageId parameter to selfservice/managedevice/getMessageBody or 2 requests via the requestId parameter to selfservice/devicemgmt/getDeviceInfoTab.htm...

PT-2015-4048

Name of the Vulnerable Software and Affected Versions Kony Management aka Enterprise Mobile Management or EMM versions 1.2 and earlier Description The issue allows remote authenticated users to read arbitrary messages or requests. This can be achieved via the messageId parameter to the...

CVE-2013-2585

Cross-site scripting XSS vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId//filenameOriginal/...

CVE-2014-0616

Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R4-S2, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows remote attackers ...

Sql injection

SQL injection vulnerability in silentumguestbook.php in Silentum Guestbook 2.0.2 allows remote attackers to execute arbitrary SQL commands via the messageid parameter...

CVE-2009-4687: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in silentumguestbook.php in Silentum Guestbook 2.0.2 allows remote attackers to execute arbitrary SQL commands via the messageid parameter...

CVE-2004-2677: Undefined Security Weakness

Format string vulnerability in qwik-smtpd.c in QwikMail SMTP qwik-smtpd 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the 1 clientRcptTo array, and the 2 Received and 3 messageID variables, possibly involving HELO and hostname arguments...

CVE-2006-0757

Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

CVE-2005-3875: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Enterprise Connector 1.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the messageid parameter in 1 send.php or 2 a delete action in messages.php...

CVE-2005-3870: Undefined Security Weakness

Multiple SQL injection vulnerabilities in edmobbs9r.php in edmoBBS 0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 table and 2 messageID parameters...

CVE-2004-1674: Undefined Security Weakness

viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to 1 delete arbitrary files via the originalfolder parameter or 2 move arbitrary files via the messageid parameter...

CVE-2005-0292: Undefined Security Weakness

Multiple SQL injection vulnerabilities in index.php in PHP Gift Registry phpGiftReg 1.4.0, and possibly other versions before 1.5.0b1, allow remote attackers to execute arbitrary SQL commands via the 1 messageid, 2 shopper, 3 shopfor, or 4 itemid parameters...