PT-2015-3648

Name of the Vulnerable Software and Affected Versions Maian Uploader version 4.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in the "admin/data files/move.php" endpoint. Recommendations For Maian Uploader version 4.0, avoi...

PT-2015-3639

Name of the Vulnerable Software and Affected Versions Ganesha Digital Library GDL version 4.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the id parameter in the "download.php" or "main.php" API endpoints. Recommendations For Ganesha Digit...

CVE-2014-100019: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the LTree converter in Pomm before 1.1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-100035: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ticket grid in the admin interface in LicensePal ArcticDesk before 1.2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-100011: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in /send-to in Sendy 1.1.9.1 allows remote attackers to execute arbitrary SQL commands via the c parameter...

Sql injection

SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php...

Sql injection

Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the 1 idcat or 2 idclient parameter to backend/main.php...

Sql injection

SQL injection vulnerability in the "thesearchfunction" function in cardozaajaxsearch.php in the AJAX Post Search cardoza-ajax-search plugin before 1.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the srchtxt parameter in a "thesearchtext" action to...

PT-2015-4969

Name of the Vulnerable Software and Affected Versions Sefrengo versions prior to 1.6.1 Description The issue allows remote administrators to execute arbitrary SQL commands. This is possible via the idcat or idclient parameter to the "backend/main.php" endpoint. Recommendations For versions prior ...

Sql injection

SQL injection vulnerability in the actionIndex function in protected/modulescore/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for...

PT-2015-4269

Name of the Vulnerable Software and Affected Versions HumHub versions 0.10.0-rc.1 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands via the from parameter to "index.php". This can be leveraged for cross-site scripting XSS attacks via a request...

CVE-2014-9520

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter...

CVE-2014-9519

SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter...

Sql injection

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter...

Sql injection

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

CVE-2014-9519

SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter...

CVE-2014-9520

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter...

CVE-2014-8083

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action...

PT-2015-4261

Name of the Vulnerable Software and Affected Versions InfiniteWP Admin Panel versions prior to 2.4.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the historyID parameter in the "execute.php" file. Recommendations For versions prior to 2.4.4...

Sql injection

SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute arbitrary SQL commands via the category parameter when displaying a category, related to the $parentid variable...