Sql injection

Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 searchstring or 2 where parameter in a contacts action, 3 deptid parameter in a departments action, 4 projectid parameter in a project action, or...

CVE-2012-5865

SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action...

CVE-2012-5865

CVE-2012-5865 concerns Achievo 1.4.5 where a SQL injection flaw exists in the dispatch.php script via the GET parameter activityid in the stats action. The vulnerability can be exploited by remote authenticated users to inject arbitrary SQL commands into the database, with the PoC indicating the ...

Sql injection

Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 return, 2 display, 3 table, or 4 search parameter to functions/suggest.php; 5 the id parameter to functions/widgets.php, 6 the category parameter to...

CVE-2012-5244

Banana Dance is affected by CVE-2012-5244 and likely earlier, affecting version B.2.6 and prior. The advisory bundle shows multiple vulnerabilities in Banana Dance (Banana Dance is a PHP/MySQL app): (1) SQL Injection in /functions/suggest.php (parameters return, display, table, search), (2) SQL I...

CVE-2012-5694: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the 1 agentPhNo, 2 controlPhNo, 3 agentURLPath, 4 agentControlKey, or 5 platformDD1 parameter to frameworkgui/attach2Agents.pl; the 6...

PT-2014-8488

Name of the Vulnerable Software and Affected Versions WordPress Spreadsheet wpSS plugin version 0.62 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the ss id parameter in the ss handler.php file. Recommendations For WordPress Spreadsheet wpSS...

PT-2014-2355

Name of the Vulnerable Software and Affected Versions Bulb Security Smartphone Pentest Framework SPF versions prior to 0.1.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters to different scripts within the frameworkgui...

PT-2014-2363

Name of the Vulnerable Software and Affected Versions Achievo version 1.4.5 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the activityid parameter in a "stats" action. The vulnerable endpoint is related to the dispatch.php file...

PT-2014-8491

Name of the Vulnerable Software and Affected Versions openSIS versions 4.5 through 5.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the Username and password variables in the "index.php" endpoint. Recommendations For openSIS...

Drupal Releases Security Advisory

Drupal has released a security advisory to address an application program interface API vulnerability CVE-2014-3704 that could allow an attacker to execute arbitrary SQL commands on an affected system. This vulnerability affects all Drupal core 7.x versions prior to 7.32. US-CERT advises users an...

Sql injection

SQL injection vulnerability in the sqlquery function in cart.php in C97net Cart Engine before 4.0 allows remote attackers to execute arbitrary SQL commands via the itemid variable, as demonstrated by the 1 itemid0 or 2 itemid parameter...

CVE-2014-8306

CVE-2014-8306 affects C97net Cart Engine prior to 4.0. The vulnerability is a SQL injection in the sql_query function of cart.php exploited through the item_id parameter (item_id[0] or item_id[]), enabling remote command execution. Public references describe the vulnerable input handling but do n...

CVE-2014-8295

SQL injection vulnerability in joblogs.php in Bacula-Web 5.2.10 allows remote attackers to execute arbitrary SQL commands via the jobid parameter...

Sql injection

SQL injection vulnerability in joblogs.php in Bacula-Web 5.2.10 allows remote attackers to execute arbitrary SQL commands via the jobid parameter...

CVE-2014-8294

CVE-2014-8294 affects Voice Of Web AllMyGuests 0.4.1. The vulnerability allows remote attackers to inject arbitrary SQL via (1) the allmyphp_cookie cookie to admin.php or (2) the Username or (3) Password fields. Root cause: SQL injection in login/auth and cookie-handling logic. Impact: arbitrary ...

CVE-2014-8295

SQL injection vulnerability in joblogs.php in Bacula-Web 5.2.10 allows remote attackers to execute arbitrary SQL commands via the jobid parameter...

PT-2014-5784

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.1.0.7 through 11.2.0.4 Oracle Database Server version 12.1.0.1 Description The issue allows remote authenticated users to affect confidentiality and integrity. Additionally, it enables remote attackers to...

CVE-2014-8766

Multiple SQL injection vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 cat parameter in a browse action to index.php or 2 unspecified parameters to admin.php...

PT-2014-8721

Name of the Vulnerable Software and Affected Versions Allomani Weblinks version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the cat parameter in a browse action to "index.php" or via unspecified parameters to "admin.php"...