15520 matches found
PT-2015-3648
Name of the Vulnerable Software and Affected Versions Maian Uploader version 4.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in the "admin/data files/move.php" endpoint. Recommendations For Maian Uploader version 4.0, avoi...
CVE-2014-100019: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
PT-2015-3673
Name of the Vulnerable Software and Affected Versions FluxBB versions prior to 1.4.13 FluxBB versions 1.5.x prior to 1.5.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the req new email parameter in the "profile.php" file. Recommendations F...
PT-2015-3627
Name of the Vulnerable Software and Affected Versions iTechClassifieds version 3.03.057 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the PreviewNum parameter in ChangeEmail.php. Recommendations For iTechClassifieds version 3.03.057, conside...
PT-2015-3659
Name of the Vulnerable Software and Affected Versions PHPJabbers Event Booking Calendar version 2.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the cid parameter in the "load-calendar.php" file. Recommendations For PHPJabbers Event Booking...
PT-2015-3661
Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin version 1.3.12 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the changeSort or switch parameter in the "usces itemedit" page to "wp-admin/admin.php"...
PT-2015-3629
Name of the Vulnerable Software and Affected Versions mTouch Quiz versions prior to 3.0.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the quiz parameter in the wp-admin/edit.php endpoint. Recommendations For versions prior to...
PT-2015-3639
Name of the Vulnerable Software and Affected Versions Ganesha Digital Library GDL version 4.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the id parameter in the "download.php" or "main.php" API endpoints. Recommendations For Ganesha Digit...
CVE-2014-100011: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in /send-to in Sendy 1.1.9.1 allows remote attackers to execute arbitrary SQL commands via the c parameter...
CVE-2014-100035: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the ticket grid in the admin interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
PT-2015-3676
Name of the Vulnerable Software and Affected Versions Taboada MacroNews version 1.0 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the id parameter in the news popup.php file. Recommendations For Taboada MacroNews version 1.0,...
Sql injection
SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php...
Sql injection
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the 1 idcat or 2 idclient parameter to backend/main.php...
Sql injection
SQL injection vulnerability in the "thesearchfunction" function in cardozaajaxsearch.php in the AJAX Post Search cardoza-ajax-search plugin before 1.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the srchtxt parameter in a "thesearchtext" action to...
PT-2015-4969
Name of the Vulnerable Software and Affected Versions Sefrengo versions prior to 1.6.1 Description The issue allows remote administrators to execute arbitrary SQL commands. This is possible via the idcat or idclient parameter to the "backend/main.php" endpoint. Recommendations For versions prior ...
Sql injection
SQL injection vulnerability in the actionIndex function in protected/modulescore/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for...
PT-2015-4269
Name of the Vulnerable Software and Affected Versions HumHub versions 0.10.0-rc.1 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands via the from parameter to "index.php". This can be leveraged for cross-site scripting XSS attacks via a request...
CVE-2014-9520
SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter...