CVE-2018-7307: Cross-Site Request Forgery (CSRF)

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter...

PT-2018-18013

Name of the Vulnerable Software and Affected Versions Auth0.js versions prior to 9.3 Description The issue arises from the mishandling of authorization responses that lack the state parameter, allowing an attacker to bypass the CSRF check. This enables the attacker to perform CSRF attacks on the...

CVE-2017-17640

Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter...

CVE-2017-17640

Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter...

Sql injection

Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter...

CVE-2017-17640: Improper Neutralization of Special Elements used in an SQL Command

Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter...

CVE-2017-16540

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

CVE-2017-16540: Exposure of Sensitive Information to an Unauthorized Actor

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

PT-2017-14441

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.0 Patch 5 Description The issue allows unauthenticated remote database copying. This is possible because setup.php exposes functionality for cloning an existing site to an arbitrary attacker-controlled MySQL serve...

US Zip Codes Database Script SQL Injection Vulnerability

US Zip Codes Database Script is a set of US Zip Codes Database Scripts. A SQL injection vulnerability exists in US Zip Codes Database Script version 1.0. A remote attacker can exploit this vulnerability to inject SQL commands with the 'state' parameter...

Sql injection

US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter...

CVE-2017-15980

US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter...

CVE-2017-15980

US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter...

CVE-2017-15980

US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter...

CVE-2017-15980

The vulnerability CVE-2017-15980 affects the US Zip Codes Database Script 1.0, where the SQL injection occurs via the state parameter in index.php?action=lookup-county&state=... The connected documents provide concrete details: attacker-supplied state input can be exploited (e.g., UNION-based pay...

PT-2017-14335

Name of the Vulnerable Software and Affected Versions US Zip Codes Database Script version 1.0 Description The issue allows SQL Injection via the state parameter. Recommendations For version 1.0, avoid using the state parameter in the affected API endpoint until the issue is resolved. Restrict...

CVE-2017-15980: Improper Neutralization of Special Elements used in an SQL Command

US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter...

Cross-Site Request Forgery (CSRF)

oauth-libre is vulnerable to cross-site request forgery attacks. The vulnerability exists because it does not incorporate state parameter logic in authorization...

SQL Injection Vulnerability in YxtCMF Online Learning System

YxtCMF online learning system is an online learning platform system developed with thinkphp+bootstrap as the framework. YxtCMF Online Learning System is vulnerable to SQL injection. The lack of filtering due to the '$state=I"get.state";' parameter allows an attacker to exploit the vulnerability t...

HackerOne: Limited CSRF bypass.

Hello team I have found an very limited CSRF which could be valid for GET requests only. And the Integrations Tab is can be used in bypass Description : Effected url :-...