Wordpress plugin image-gallery-with-slideshow SQL injection vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Wordpress plugin image-gallery-with-slideshow SQL injection vulnerability, the vulnerability stems from the program failing t...

WordPress wordpress-gallery-transformation SQL Injection Vulnerability

WordPress wordpress-gallery-transformation is a website wallpaper plugin for WordPress. WordPress wordpress-gallery-transformation version 1.0 in . /wordpress-gallery-transformation/gallery.php in version 1.0 contains a SQL injection vulnerability that stems from the program failing to filter the...

WordPress Membership Simplified SQL Injection Vulnerability

WordPress Membership Simplified is a WordPress-specific membership plugin developed by American software developer William. A SQL injection vulnerability exists in the code of the membership-simplified-for-oap-members-only/updateDB.php file in WordPress Membership Simplified version 1.58, which...

UBUNTU-CVE-2017-14242

SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter...

SQL Shortcode <= 1.1 - Authenticated SQL Execution

It's not an SQL injection actually, it's just executing SQL with an account as low-privileged as a subscriber. The plugin description says it all. This https://blog.sucuri.net/2016/08/sql-injection-vulnerability-ninja-forms.html great article will help understanding how to exploit shortcodes and...

SQL Shortcode <= 1.1 - Authenticated SQL Execution

It's not an SQL injection actually, it's just executing SQL with an account as low-privileged as a subscriber. The plugin description says it all. This https://blog.sucuri.net/2016/08/sql-injection-vulnerability-ninja-forms.html great article will help understanding how to exploit shortcodes and...

Command Execution Vulnerability in Xinqi Online Learning System /ajax/GetForm.ashx Page

Online Learning System is an e-learning platform system developed in . A command execution vulnerability exists in the /ajax/GetForm.ashx page of Xinqi Online Learning System. An attacker can exploit this vulnerability to execute arbitrary SQL statements...

ThinkPHP5 PDO Authenticity Preprocessing suffers from SQL Injection Vulnerability

ThinkPHP V5.0 is a high-performance framework designed for API development. A SQL injection vulnerability exists in ThinkPHP5 PDO authenticity preprocessing. The vulnerability is caused by controlling the value position of the in statement, i.e. by passing in an array, leading to a SQL injection...

SQL Injection

Moodle is vulnerable to SQL injection attacks. The library does not sanitize form data, allowing a malicious user can inject and execute arbitrary SQL...

YXCMS backend new template with SQL execution function has arbitrary file write vulnerability

Yxcms is an enterprise building system based on PHP and mysql technology. YXCMS backend new templates and SQL execution function has arbitrary file write vulnerability, attackers can exploit the vulnerability to write webshell, get server privileges...

CSRF Vulnerability in Ocean CMS V6.48

Ocean Movie System aka Ocean CMS seacms is a PHP movie system. There is a CSRF vulnerability in the back-end SQL execution form of Ocean CMS, which can be exploited by attackers to trick administrators into clicking on malicious links to execute SQL statements and write webshell to gain server...

WordPress Mail Masta plugin SQL injection vulnerability (CNVD-2017-02638)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Mail Masta aka mail-masta is one of the email plug-ins. WordPress Mail Masta plugin version 1.0 in...

CVE-2016-5742

SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

dotCMS 'stName' Parameter SQL Injection Vulnerability

dotCMS is a content management system CMS developed in Java. A SQL injection vulnerability exists in the 'stName' parameter in dotCMS versions prior to 3.3.2, which allows remote attackers to execute arbitrary SQL commands via the stName parameter in api/content/save/1...

IBM BigFix Remote Control SQL Injection Vulnerability

IBM BigFix Remote Control is a set of remote control systems from IBM in the United States. A SQL injection vulnerability exists in IBM BigFix Remote Control 9.1.2 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary SQL commands...

SweetRice 1.5.1 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications document.forms0.submit; 0day.today 2018-01-01...

CVE-2016-8582

A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOADFILE...

vBulletin forumrunner/includes/moderation.php SQL Injection Vulnerability

VBulletin is a powerful, flexible and fully customizable suite of forum programs. A SQL injection vulnerability exists in the forumrunner/includes/moderation.php file in versions of vBulletin prior to 4.2.2 Patch Level 5 and prior to 4.2.3 Patch Level 1. A remote attacker can exploit this...

miniMySQLAdmin 1.1.3 - Cross-Site Request Forgery (SQL Execution)

miniMySQLAdmin 1.1.3 - Cross-Site Request Forgery SQL Execution document.forms.csrfpoc.submit; select from user order by User asc limit 20 Host User % exploituser1 --...

Symphony CMS SQL Injection Vulnerability

Symphony is a content management system CMS developed using PHP MySQL. Symphony suffers from a SQL injection vulnerability because the program fails to adequately validate the 'fieldsusername', 'actionsave', and 'fieldsemail' parameters can be exploited to execute arbitrary SQL code in the...