TestLink SQL Injection Vulnerability (CNVD-2017-32128)

Testlink is TestLink team developed a PHP-based open source test management tool . The tool provides test requirements management , test case management and test data statistics and other functions . SQL injection vulnerability exists in versions of TestLink before 1.9.14. A remote attacker can...

Sql injection

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...

CVE-2015-7390: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php...

CVE-2017-7991: Improper Neutralization of Special Elements used in an SQL Command

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

Sql injection

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

CVE-2016-7789: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

Split-Flap Cross Site Scripting

Split-Flap - Reflected Cross Site Scriptingweather.php, flights.php Exploit Title: Split-Flap - Reflected Cross Site Scriptingweather.php, flights.php Date: 2016-06-10 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/baspete/Split-Flap ,...

TestLink SQL Injection Vulnerability (CNVD-2016-01142)

Testlink is a PHP-based open source test management tools . A SQL injection vulnerability exists in TestLink. The vulnerability is caused by the "apikey" HTTP GET parameter failing to filter via the "lnl.php" PHP script. An unauthenticated remote attacker can inject and execute arbitrary SQL...