870 matches found
DotCMS SQL Injection Vulnerability (CNVD-2016-11003)
DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A SQL injection vulnerability exists in the Site BrowserContainers pages screen in versions of DotCMS prior to...
SolarWinds Storage Resource Monitor Profiler Module HostStorageServlet SQL Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Storage Resource Monitor Profiler Module. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of the HostStorageServlet servlet in th...
PHPBack SQL Injection Vulnerability
PHPback is an open source web application feedback system that provides users with feedback on issues and suggestions to help improve the site. A SQL injection vulnerability exists in the 'orderby' parameter in PHPBack version 3.0. Allow attackers to exploit the vulnerability to modify the conten...
PHPback 'orderby' parameter SQL injection vulnerability
PHPback is an open source web application feedback system that provides users with feedback on issues and suggestions to help improve the site. A SQL injection vulnerability exists in PHPback version 1.3.0. An attacker can exploit the vulnerability by constructing a SQL statement containing the...
DotCMS Workflow Screen SQL Injection Vulnerability
DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A SQL injection vulnerability exists in Workflow Screen in DotCMS versions prior to 3.3.2. A remote attacker ca...
CVE-2016-4040
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter...
CVE-2016-4040
CVE-2016-4040 affects dotCMS prior to version 3.3.2. A SQL injection in the Workflow Screen allows remote administrators to execute arbitrary SQL commands through the orderby parameter. Exploitation would impact data confidentiality, integrity, and availability as described by CVSS metrics (base ...
CVE-2016-4040
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter...
PT-2016-5816
Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.3.2 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the orderby parameter in the Workflow Screen. Recommendations For versions prior to 3.3.2, update to...
CVE-2016-4040: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter...
SocialEngine SQL Injection Vulnerability
SocialEngine is a PHP-based social networking platform that allows the creation of social networks on websites. An injection vulnerability exists in SocialEngine SQL. Due to insufficient filtering of input passed to the "/index.php" script via the "orderby" HTTP GET parameter, an unauthenticated...
Discuz问卷调查专业版插件参数orderby存在SQL注入漏洞
No description provided by source...
Sql injection
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...
CVE-2014-6242: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...
Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities
No description provided by source. Document Title: =============== Onpub CMS 1.4 & 1.5 - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1120 Release Date: ============= 2013-10-26 Vulnerability Laboratory ID VL-ID:...
Jetbox CMS 2.1 admin/cms/images.php orderby Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/31824/info Jetbox CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...
PT-2014-2495
Name of the Vulnerable Software and Affected Versions PHP-Fusion versions prior to 7.02.06 Description The issue allows remote attackers to execute arbitrary SQL commands via various parameters in different PHP files, including the orderby parameter to "downloads.php", and several parameters in...
PT-2014-2475
Name of the Vulnerable Software and Affected Versions Wysija Newsletters plugin versions prior to 2.2.1 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the search or orderby parameter to "wp-admin/admin.php". This can be leveraged using CSRF ...
CVE-2013-1408: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the 1 search or 2 orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote...