CVE-2020-20914

SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter...

PT-2023-11566

Name of the Vulnerable Software and Affected Versions San Luan PublicCMS version 4.0 Description A SQL Injection issue allows a remote attacker to execute arbitrary code via the sql parameter. This enables the attacker to potentially access or modify sensitive data. Recommendations For San Luan...

CVE-2020-20914: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter...

CVE-2020-20915: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl...

PT-2022-21932 · Unknown · Wp All Export Pro

Name of the Vulnerable Software and Affected Versions: WP All Export Pro versions prior to 1.7.9 Description: The issue allows users with permission to run exports to execute arbitrary SQL statements due to the direct use of the cc sql POST parameter as a database query. This affects users who ha...

CVE-2022-25225

Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...

CVE-2022-25225

Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation PostgreSQL by exploiting this issue...

CVE-2021-45406: Improper Neutralization of Special Elements used in an SQL Command

In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password...

PT-2022-12343

Name of the Vulnerable Software and Affected Versions SalonERP version 3.0.1 Description A SQL injection issue allows an attacker to inject a payload using the sql parameter in a SQL query while generating a report. This can lead to the discovery of the login admin password hash, which can then b...

Cross site scripting

Sahi Pro 8.0.0 has a script manager arena located at s/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can be used to trigger...

CVE-2019-13066: Improper Neutralization of Input During Web Page Generation

Sahi Pro 8.0.0 has a script manager arena located at s/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can be used to trigger...

PT-2019-19754

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue in OFCMS allows SQL injection, related to the SystemGenerateController.java file. This is specifically exploitable through the "admin/system/generate/create" API endpoint with the sql paramete...

CVE-2018-18626

An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...

CVE-2018-18626: Undefined Security Weakness

An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...

CVE-2018-14961: Improper Neutralization of Special Elements used in an SQL Command

dl/dlsendmail.php in zzcms 8.3 has SQL Injection via the sql parameter...

PT-2018-12838

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to SQL Injection via the sql parameter in the dl/dl sendmail.php file. Recommendations For version 8.3, consider restricting access to the dl/dl sendmail.php file until a patch is available, a...

CVE-2018-6382: Improper Neutralization of Special Elements used in an SQL Command

MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in JAMon Java Application Monitor 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 listenertype or 2 currentlistener parameter to mondetail.jsp or ArraySQL parameter to 3 mondetail.jsp, 4 jamonadmin.jsp, 5...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in meBiblio 0.4.7 allow remote attackers to inject arbitrary web script or HTML via the 1 sql parameter to dbadd.inc.php, 2 InsertJournal parameter to addjournalmask.inc.php, 3 InsertBibliography parameter to insertmask.inc.php, and 4 LabelYear...

CVE-2008-2646

Multiple cross-site scripting XSS vulnerabilities in meBiblio 0.4.7 allow remote attackers to inject arbitrary web script or HTML via the 1 sql parameter to dbadd.inc.php, 2 InsertJournal parameter to addjournalmask.inc.php, 3 InsertBibliography parameter to insertmask.inc.php, and 4 LabelYear...