CVE-2017-9771: Improper Control of Generation of Code

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

WebsiteBaker SQL Injection Vulnerability (CNVD-2017-08709)

WebsiteBaker is an open source PHP content management system CMS maintained and developed by the WebsiteBaker organization. The system supports WYSIWYG editor, search engine optimization and add-ons. A SQL injection vulnerability exists in the /account/details.php file in WebsiteBaker version...

WebsiteBaker cross-site scripting vulnerability (CNVD-2017-08708)

WebsiteBaker is an open source PHP content management system CMS maintained and developed by the WebsiteBaker organization. The system supports WYSIWYG editor, search engine optimization and add-ons. A cross-site scripting vulnerability exists in the /account/details.php file in WebsiteBaker...

CVE-2017-9361

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php...

Sql injection

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

CVE-2017-9360

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

Cross site scripting

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php...

CVE-2017-9360

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

CVE-2017-9360

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

CVE-2017-9361

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php...

CVE-2017-9361

WebsiteBaker v2.10.0 is affected by a stored XSS vulnerability in /account/details.php (CVE-2017-9361). The CNVD entry CNVD-2017-08708 states the vulnerability exists in WebsiteBaker 2.10.0 and a remote attacker can inject arbitrary web script or HTML. The EU/NVD records similarly describe a stor...

CVE-2017-9360

WebsiteBaker v2.10.0 is affected by a SQL injection in /account/details.php. The CNVD entry confirms a remote attacker can exploit this to execute arbitrary SQL commands, implying severe impact on confidentiality, integrity, and possibly availability. The CVE entry itself notes a SQL injection vu...

CVE-2017-9360: Improper Neutralization of Special Elements used in an SQL Command

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

CVE-2017-9361: Improper Neutralization of Input During Web Page Generation

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php...

Multiple SQL Injection Vulnerabilities in WebsiteBaker

websitebaker is an open source content management system CMS. Websitebaker has multiple SQL injection vulnerabilities. Because account/signup.php does not properly handle the values of the variables "username" and "displayname", a remotely authenticated attacker registration is turned on by defau...

CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

Sql injection

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

CVE-2017-7410

CVE-2017-7410 affects WebsiteBaker 2.10.0 and earlier. Multiple SQL injection vulnerabilities exist in account/signup.php and account/signup2.php where the username and display_name parameters allow remote attackers to alter the SQL query and execute arbitrary SQL commands. Public metrics indicat...

CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...