926 matches found
CVE-2018-18529: Improper Neutralization of Special Elements used in an SQL Command
ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...
CVE-2018-18530: Improper Neutralization of Special Elements used in an SQL Command
ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI...
PT-2018-14497
Name of the Vulnerable Software and Affected Versions ThinkPHP version 5.1.25 Description The issue is related to SQL Injection via the count parameter. This occurs because the library/think/db/Query.php aggregate function mishandles the aggregate variable. The attack requires a backquote charact...
SQL Injection Vulnerability in LFCMS v3.8.6
LFCMS is a film and television content management system developed in PHP and based on THINKPHP framework suitable for all kinds of video, film and television websites. LFCMS v3.8.6 exists SQL injection vulnerability, the vulnerability stems from the failure to filter pid parameters, attackers ca...
ThinkPHP SQL Injection Vulnerability (CNVD-2018-20227)
ThinkPHP is an open source, lightweight PHP-based web application development framework. A SQL injection vulnerability exists in the 'delete' function in ThinkPHP version 5.1.24. A remote attacker can exploit this vulnerability by controlling the value of the query parameter to delete a user...
CVE-2018-17566
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...
CVE-2018-17566
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...
Sql injection
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...
CVE-2018-17566
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...
CVE-2018-17566
In ThinkPHP 5.1.24, the inner function delete is vulnerable to SQL injection when the WHERE condition value can be controlled by a user, enabling attackers to alter queries. The CVE-2018-17566 entry is supported by multiple sources (e.g., GHSA/CNVD/NVD) and notes the vulnerability stems from the ...
CVE-2018-17566: Improper Neutralization of Special Elements used in an SQL Command
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request...
PT-2018-14057
Name of the Vulnerable Software and Affected Versions ThinkPHP version 5.1.24 Description The issue allows for SQL injection when the delete function's WHERE condition value can be controlled by a user's request. This can potentially lead to unauthorized data access or modification. Recommendatio...
Design/Logic Flaw
Gxlcms 1.0 has XSS via the PATHINFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php...
PT-2018-13676
Name of the Vulnerable Software and Affected Versions Gxlcms version 1.0 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the PATH INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php, allowing for the injection of...
SQL Injection
ThinkPHP is vulnerable to SQL injection. A remote attacker is able to inject arbitrary SQL commands through the public/index/index/test/index query string...
CVE-2018-16385
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string...
CVE-2018-16385
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string...
Sql injection
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string...
CVE-2018-16385
ThinkPHP (PHP framework) is vulnerable to SQL injection in all versions before 5.1.23. The flaw allows a remote attacker to inject SQL via the public/index/index/test/index query string, potentially compromising database integrity and confidentiality. Affected product/version: ThinkPHP prior to 5...