CVE-2018-16822

SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...

CVE-2018-16822

SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...

CVE-2018-3883

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sortorder parameter can be used to perform an SQL injection attack. An attacker can use a browser ...

PT-2018-16276

Name of the Vulnerable Software and Affected Versions ERPNext version 10.1.6 Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause SQL injections, resulting in data compromise. The employee and sort order paramete...

baijiacms SQL Injection Vulnerability

baijiacms is a content management system CMS for e-commerce. A SQL injection vulnerability exists in version 4 of baijiacms, which can be exploited by a remote attacker to obtain data from the database using the 'order' parameter in the index.php?act=index request...

CVE-2018-16724

An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request...

WordPress Pie Register Blind SQL Injection

============================================= MGC ALERT 2018-004 - Original release date: May 10, 2018 - Last revised: June 11, 2018 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2018-10969 ============================================= I. VULNERABILITY...

CVE-2016-10550

The CVE-2016-10550 issue affects sequelize (ORM for Node.js) where user input into limit or order parameters can be used to inject SQL. Concrete details across documents show affected version: 3.16.0 and earlier. Root cause is improper handling of input in query construction, enabling SQL stateme...

Apache Fineract SQL Injection Vulnerability (CNVD-2018-09809)

Apache Fineract is a set of open source digital financial services platform of the U.S. Apache Apache Software Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. An SQL injection vulnerability...

Enhancesoft osTicket cross-site scripting vulnerability (CNVD-2018-07905)

Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A cross-site scripting vulnerability exists in the /scp/directory.php file in Enhancesoft osTicket versions prior to 1.10.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the...

Cross site scripting

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

CVE-2018-7193

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

CVE-2018-7193

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

WordPress WooCommerce Plugin Crafted Order XSS Vulnerability - Windows

WooCommerce Plugin for WordPress is prone to a cross-site scripting XSS vulnerability. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

PT-2018-17528 · Sangoma · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX versions 10.13.66-32bit and 14.0.1.24 SNG7-PBX-64bit-1712-2 Description: The issue allows post-authentication SQL injection via the order parameter. It is noted that the vendor disputes this issue, stating it is intentional for users ...

Easy Car Script SQL Injection Vulnerability

Easy Car Script is a set of online car category display scripts. A SQL injection vulnerability exists in the 2014 version of Easy Car Script. A remote attacker can exploit the vulnerability by sending the 'sorder' or 'srow' parameter to the sitesearch.php file to inject SQL commands...

WordPress WpJobBoard plugin SQL injection vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . WpJobBoard plugin is used in one of the job management plugin . A SQL injection vulnerability exists in WordPress...

CVE-2018-5695

The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php...

Sql injection

Icy Phoenix 2.2.0.105 allows SQL injection via an unapprove request to adminkbart.php or the order parameter to adminjradmin.php, related to functionskb.php...

GHSA-XQG8-CV3H-XPPV SQL Injection in sequelize

Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 or later...