CVE-2021-33730: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

Command injection

Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL...

CVE-2021-28142: Improper Neutralization of Special Elements used in an SQL Command

CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."...

CVE-2021-23352: Improper Neutralization of Special Elements used in an SQL Command

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image, .svg or .dot functions are called, is executed by the childprocess.exec function...

CVE-2021-1247: Improper Neutralization of Special Elements used in an SQL Command

Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2020-14349: Improper Neutralization of Special Elements used in an SQL Command

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the searchpath during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the...

CVE-2020-23936: Improper Neutralization of Special Elements used in an SQL Command

PHPGurukul Vehicle Parking Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin' && Password: Write Something"...

CVE-2020-8802: Improper Neutralization of Special Elements used in an SQL Command

SuiteCRM through 7.11.11 has Incorrect Access Control via actionsaveHTMLField Bean Manipulation...

CVE-2019-17370: Improper Neutralization of Special Elements used in an SQL Command

OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFiledeal.php blocks "into outfile" in a SELECT statement, but does not block the "into//outfile" manipulation. Therefore, the attacker can create a .php file...

CVE-2019-9885: Improper Neutralization of Special Elements used in an SQL Command

eClass platform ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenviewleft.php StudentID parameter...

CVE-2019-13373: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in the D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL...

MISP 2.4.97 - SQL Command Execution via Command Injection in STIX Module

--coding:utf-8-- Exploit Title: SQL command execution via command injection in STIX module Date: 2019-17-02 Exploit Author: Tm9jdGlz Vendor Homepage: https://www.misp-project.org/ Software link: https://www.misp-project.org/download/ Version: 2.4.90 - 2.4.99 Tested on: 2.4.97 CVE: CVE-2018-19908...

CVE-2019-6523: Improper Neutralization of Special Elements used in an SQL Command

WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands...

CVE-2018-3783: Improper Neutralization of Special Elements used in an SQL Command

A privilege escalation detected in flintcms versions = 1.1.9 allows account takeover due to blind MongoDB injection in password reset...

CVE-2018-2450: Improper Neutralization of Special Elements used in an SQL Command

SAP MaxDB liveCache, versions 7.8 and 7.9, allows an attacker who gets DBM operator privileges to execute crafted database queries and therefore read, modify or delete sensitive data from database...

CVE-2018-12039: Improper Neutralization of Special Elements used in an SQL Command

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

KomSeo Cart 1.3 SQL Injection

Exploit Title: KomSeo Cart 1.3 - 'edit.php' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor: SITEMAKIN Vendor Homepage: https://sitemakin.com Version: 1.3 Category: Webapps Tested on: Kali linux Description : The vulnerability allows an attacker to inject...

CVE-2017-17658: Improper Neutralization of Special Elements used in an SQL Command

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobDefinitions Get method requests. The issue...

CVE-2017-17419: Improper Neutralization of Special Elements used in an SQL Command

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUTransferHistory Get method requests. The issue...

CVE-2017-1002023: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easyteammanagerdescedit.php...