839 matches found
KomSeo Cart 1.3 SQL Injection
Exploit Title: KomSeo Cart 1.3 - 'edit.php' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor: SITEMAKIN Vendor Homepage: https://sitemakin.com Version: 1.3 Category: Webapps Tested on: Kali linux Description : The vulnerability allows an attacker to inject...
CVE-2018-10595
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor to issue SQL commands, which may result in loss or corruption of data...
CVE-2018-10593
CVE-2018-10593 affects BD Kiestra DB Manager (v3.0.1.0 and earlier) and PerformA (v3.0.0.0 and earlier). An authorized user with a privileged BD Kiestra account can issue SQL commands, potentially leading to data corruption on Kiestra TLA, WCA, and InoqulA+ systems. The connected ICS-CERT advisor...
CVE-2018-10595
CVE-2018-10595 affects the ReadA component in BD Kiestra systems (ReadA 1.1.0.2 and earlier) where an authorized user with privileged access can issue SQL commands, potentially causing data loss or corruption. The related ICS advisory (ICSMA-18-142-01) confirms this vulnerability across BD Kiestr...
CVE-2018-0530: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2014-2652: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in OpenScape Deployment Service DLS before 6.x and 7.x before R1.11.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2017-17419: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUTransferHistory Get method requests. The issue...
CVE-2017-17658: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobDefinitions Get method requests. The issue...
Web servers PHPMyAdmin Suspicious Table Hyperlink (CVE-2017-1000499)
A PhpMyAdmin user could be subject to a phishing attack. This is due to the way PhpMyAdmin handles modify requests. A successful attack could lead to malicious SQL command execution...
PT-2017-11592
Name of the Vulnerable Software and Affected Versions A-Member and A-Member for MT cloud versions 3.8.6 and earlier Description The issue allows an attacker to execute arbitrary SQL commands via unspecified vectors. This can potentially lead to unauthorized access and manipulation of sensitive...
CVE-2017-14723: Improper Neutralization of Special Elements used in an SQL Command
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...
How to delete the Device Entry for a User directly from the SQL Database
For some reason like datacorruption or some null pointers, device information is not getting removed fromthe XenMobile Console. This can be deleted directly from the Database by running the below SQL command. Please take the DB back up before we run the below SQL query First obtain the Device ID...
CVE-2017-1002023: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easyteammanagerdescedit.php...
DeWorkshop 1.0 - Arbitrary File Upload Vulnerability
Exploit for php platform in category web applications Exploit Title: DeWorkshop 1.0 - Arbitrary File Upload Dork: N/A Date: 18.08.2017 Vendor Homepage : https://sarutech.com/ Software Link: https://codecanyon.net/item/deworkshop-auto-workshop-portal/20336737 Demo:...
LiveInvoices 1.0 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: LiveInvoices 1.0 - SQL Injection Dork: N/A Date: 18.08.2017 Vendor Homepage : http://livecrm.co/ Software Link: https://codecanyon.net/item/liveinvoices-complete-invoicing-system-crm/20243375 Demo:...
CVE-2017-1183: Improper Neutralization of Special Elements used in an SQL Command
IBM Tivoli Monitoring Portal v6 could allow a local network adjacent attacker to modify SQL commands to the Portal Server, when default client-server communications, HTTP, are being used. IBM X-Force ID: 123494...
CVE-2017-7681: Improper Neutralization of Special Elements used in an SQL Command
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end...
PT-2017-12262
Name of the Vulnerable Software and Affected Versions IBM Tivoli Monitoring Portal version 6 Description The issue allows a local attacker to modify SQL commands to the Portal Server when default client-server communications over HTTP are used. Recommendations For IBM Tivoli Monitoring Portal...
(0Day) Schneider Electric U.motion Builder SOAP Request Remote SQL Command Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary SQL commands on vulnerable installations of Schneider Electric U.Motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of SOAP requests by the web service. The system...