CVE-2018-18530

ThinkPHP 5.1.25 contains a SQL Injection via the count parameter caused by mishandling of the aggregate variable in library/think/db/Query.php. The flaw enables injection with a backquote character in the attack URI. Affected product: ThinkPHP (PHP framework); root cause: aggregate handling in Qu...

SQL Injection Vulnerability in LFCMS v3.8.6

LFCMS is a film and television content management system developed in PHP and based on THINKPHP framework suitable for all kinds of video, film and television websites. LFCMS v3.8.6 exists SQL injection vulnerability, the vulnerability stems from the failure to filter pid parameters, attackers ca...

ThinkPHP SQL Injection Vulnerability (CNVD-2018-20227)

ThinkPHP is an open source, lightweight PHP-based web application development framework. A SQL injection vulnerability exists in the 'delete' function in ThinkPHP version 5.1.24. A remote attacker can exploit this vulnerability by controlling the value of the query parameter to delete a user...

CVE-2018-17566

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...

CVE-2018-17566

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...

Sql injection

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...

CVE-2018-17566

In ThinkPHP 5.1.24, the inner function delete is vulnerable to SQL injection when the WHERE condition value can be controlled by a user, enabling attackers to alter queries. The CVE-2018-17566 entry is supported by multiple sources (e.g., GHSA/CNVD/NVD) and notes the vulnerability stems from the ...

CVE-2018-17566

In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...

Design/Logic Flaw

Gxlcms 1.0 has XSS via the PATHINFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php...

SQL Injection

ThinkPHP is vulnerable to SQL injection. A remote attacker is able to inject arbitrary SQL commands through the public/index/index/test/index query string...

Sql injection

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string...

CVE-2018-16385

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string...

CVE-2018-16385

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string...

CVE-2018-16385

ThinkPHP (PHP framework) is vulnerable to SQL injection in all versions before 5.1.23. The flaw allows a remote attacker to inject SQL via the public/index/index/test/index query string, potentially compromising database integrity and confidentiality. Affected product/version: ThinkPHP prior to 5...

CVE-2018-16385

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string...

ThinkPHP SQL Injection Vulnerability (CNVD-2019-17159)

ThinkPHP is an open source, lightweight PHP-based web application development framework. A SQL injection vulnerability exists in ThinkPHP versions prior to 5.1.23. The vulnerability stems from the program not correctly filtering the key value of an array, which can be exploited by a remote attack...

ThinkPHP 3.X/5.X order by injection vulnerability

ThinkPHP is a lightweight PHP development framework. A security vulnerability exists in ThinkPHP. The vulnerability is due to ThinkPHP in the processing of order by sorting, when the sorting parameters are controllable and associated arrays key-value, the framework does not make security filterin...

tp5cms Cross-Site Request Forgery Vulnerability

tp5cms is a content management system CMS framework written in the PHP language and based on technologies such as ThinkPHP, swiper and bootstrap. A cross-site request forgery vulnerability exists in tp5cms 2017-05-25 and earlier versions. A remote attacker can exploit this vulnerability to delete...

tp5cms Cross-site Scripting Vulnerability

tp5cms is a content management system CMS framework written in the PHP language and based on technologies such as ThinkPHP, swiper and bootstrap. A cross-site scripting vulnerability exists in tp5cms 2017-05-25 and earlier versions. A remote attacker can exploit this vulnerability to inject...

OneThink Cross-Site Request Forgery Vulnerability

Onethink is a ThinkPHP-based content management framework for web development . A cross-site request forgery vulnerability exists in the admin.php?s=/AuthManager/addToGroup.html page in OneThink version 1.1. A remote attacker can exploit this vulnerability to gain administrator privileges...