273 matches found
Cross site scripting
WeBid version up to current version 1.2.2 contains a Cross Site Scripting XSS vulnerability in userlogin.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must clic...
Sql injection
WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit...
Directory traversal
WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit...
CVE-2018-1000882
WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit...
CVE-2018-1000882
CVE-2018-1000882 concerns WeBid up to version 1.2.2, where a directory traversal vulnerability exists in the getthumb.php script, allowing Arbitrary Image File Read. The issue is exploitable via HTTP GET requests and is caused by insufficient validation of file paths in getthumb.php. Multiple con...
CVE-2018-1000868
WeBid version up to current version 1.2.2 contains a Cross Site Scripting XSS vulnerability in userlogin.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must clic...
CVE-2018-1000867
Affected software: WeBid (up to current version 1.2.2). Vulnerability: SQL Injection in all five yourauctions*.php scripts, allowing (via HTTP requests) a Blind SQL Injection that can cause database read. Root cause: improper input handling in the listed PHP scripts. Impact: potential data exposu...
CVE-2018-1000867
WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit...
CVE-2018-1000868
WeBid up to version 1.2.2 is affected by a Cross-Site Scripting (XSS) vulnerability in user_login.php and register.php. The issue allows execution of JavaScript in a user’s browser when a victim user clicks a malicious link, via injected markup on the affected pages. The vulnerability is fixed af...
CVE-2018-1000868: Improper Neutralization of Input During Web Page Generation
WeBid version up to current version 1.2.2 contains a Cross Site Scripting XSS vulnerability in userlogin.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must clic...
CVE-2018-1000867: Improper Neutralization of Special Elements used in an SQL Command
WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit...
CVE-2018-1000882: Improper Limitation of a Pathname to a Restricted Directory
WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit...
CVE-2011-10011
creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webidconverter.rb 2025-10-23 21:12:56+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:49:02+00:00| seen|...
WeBid 1.1.2P2 SQL Injection
Advisory ID: HTB23292 Product: WeBid Vendor: WeBid Vulnerable Versions: 1.1.2P2 and probably prior Tested Version: 1.1.2P2 Advisory Publication: January 22, 2016 without technical details Vendor Notification: January 22, 2016 Vendor Patch: February 4, 2016 Public Disclosure: February 17, 2016...
WeBid SQL Injection Vulnerability
WebID is the serial number of ESET antivirus software that can be obtained automatically. An SQL injection vulnerability exists in WeBid. Because the '$SESSION"id"' talkback variable is not properly filtered, an attacker can exploit the vulnerability to alter raw SQL queries and execute arbitrary...
SQL Injection in WeBid
High-Tech Bridge Security Research Lab discovered SQL Injection vulnerability in a poplar web auction software WeBid. The vulnerability can be exploited by remote non-authenticated attacker to alter present SQL query and execute arbitrary SQL commands in application's database. Successful...
SQL Injection Vulnerability in the Webid Parameter of the Hot.aspx Page of the Online Query System of Shanghai Caixa Science and Technology Development Corporation's Kefa...
Shanghai Cai Da Science and Technology Development Corporation Kofa online query system is a comprehensive query system for financial information. The product has a SQL injection vulnerability, the vulnerability URL is: /hot.aspx?mid1=&mid2=&webid=, the vulnerability parameter is webid, the...
WeBid 'ajax.php' Arbitrary File Upload Vulnerability
WeBid is an open source auction site building solutions. An arbitrary file upload vulnerability exists in WeBid that stems from the program failing to adequately filter user-submitted input. An attacker can exploit this vulnerability to upload arbitrary files to an affected computer and execute...
