CVE-2017-18291: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter...

PT-2018-6809

Name of the Vulnerable Software and Affected Versions: PvPGN Stats version 2.4.6 Description: A SQL Injection issue exists in the ladder/stats.php file via the user parameter in the GET request. Recommendations: For PvPGN Stats version 2.4.6, consider restricting access to the ladder/stats.php fi...

CVE-2018-9991

Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the 1 printer name when adding a printer in the admin panel or 2 username parameter to webapp/users/userreg.jsp...

PT-2017-7163

Name of the Vulnerable Software and Affected Versions puppetlabs-mysql versions 3.1.0 through 3.6.0 Description The issue allows remote attackers to bypass authentication by leveraging the creation of a database account without a password when a mysql user user parameter contains a host with a...

CVE-2015-3934

Multiple SQL injection vulnerabilities in Fiyo CMS 2.01.9.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to apps/apparticle/controller/rating.php or 2 user parameter to user/login...

WordPress Support Ticket System SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Support Ticket System plugin is one of the ticket system plugin. A SQL injection vulnerability exists in WordPress...

CVE-2015-7670: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 user or 2 id parameter...

PT-2017-13039

Name of the Vulnerable Software and Affected Versions T&W WIFI Repeater BE126 version not specified Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to "cgi-bin/webupg". Recommendations For T&W WIFI Repeater BE126,...

CVE-2017-11494: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a login action...

PT-2017-12048

Name of the Vulnerable Software and Affected Versions SOL.Connect ISET-mpp meter versions 1.2.4.2 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the user parameter in a "login action". Recommendations For versions 1.2.4.2 and...

PHPSHE B2C mall system user.php parameter has sql injection vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. A SQL injection vulnerability exists in the user.p...

SimpleRisk Cross-Site Scripting Vulnerability

SimpleRisk is an open source risk management tool developed by American software developer Josh Sokol. The tool tracks and displays the status of systems, teams and security technologies as well as ongoing risk mitigation projects through a risk management dashboard. A cross-site scripting...

CVE-2017-10711

In SimpleRisk 20170614-001, a CSRF attack on reset.php aka the Send Password Reset Email form can insert XSS sequences via the user parameter...

CVE-2017-10711

In SimpleRisk 20170614-001, a CSRF attack on reset.php aka the Send Password Reset Email form can insert XSS sequences via the user parameter...

CVE-2017-10711

In SimpleRisk 20170614-001, a CSRF attack on reset.php aka the Send Password Reset Email form can insert XSS sequences via the user parameter...

CVE-2017-10711: Improper Neutralization of Input During Web Page Generation

In SimpleRisk 20170614-001, a CSRF attack on reset.php aka the Send Password Reset Email form can insert XSS sequences via the user parameter...

PT-2017-11445

Name of the Vulnerable Software and Affected Versions SimpleRisk version 20170614-001 Description A CSRF attack on the 'reset.php' endpoint, specifically the Send Password Reset Email form, can insert XSS sequences via the user parameter. Recommendations For version 20170614-001, consider disabli...

NEC UNIVERGE UM4730 < 11.8 - SQL Injection

Exploit Title: NEC UNIVERGE UM4730 11.8 SQL injection Vulnerbility: SQL injection login bypass Date: 15-12-2016 Exploit Author: b0x41s Author web: https://www.xrayit.nl Vendor Homepage: https://www.nec-enterprise.com Category: webapps Version: 11.6.0.31 Tested on: Windows server 2008 Description:...

KMCIS CaseAware - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: CaseAware Cross Site Scripting Vulnerability Date: 20th May 2017 Exploit Author: justpentest Vendor Homepage: https://caseaware.com/ Version: All the versions Contact: email protected CVE : 2017-5631 Source:...