FineCMS v5.2.0 SQL注入

在/finecms/dayrui/controllers/Api.php第45行： template-cron = 0; $GET'page' = max1, int$this-input-get'page'; $params = drstring2arrayurldecode$this-input-get'params'; $params'get' = @jsondecodeurldecode$this-input-get'get', TRUE; $this-template-assign$params; $name = strreplacearray'\', '/', '..',...

Enalean Tuleap SQL Injection Vulnerability (CNVD-2018-06466)

Enalean Tuleap software engineering platform is an open source software development and project management platform from Enalean, France. The platform provides enterprise application lifecycle management , as well as project tracking , source code management and team collaboration and other...

CVE-2018-7538

A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands...

CVE-2018-7538

A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands...

PT-2018-18142

Name of the Vulnerable Software and Affected Versions Enalean Tuleap software engineering platform versions prior to 9.18 Description A SQL injection issue in the tracker functionality allows attackers to execute arbitrary SQL commands. Recommendations For versions prior to 9.18, update to versio...

CVE-2018-7538: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands...

ClipBucket SQL Injection Vulnerability (CNVD-2018-04993)

ClipBucket is an open source video sharing software developed by Arslan team. The software allows you to share videos to video sites and supports the lights off effect when watching a movie. A SQL injection vulnerability exists in versions prior to ClipBucket 4.0.0 Release 4902. A remote attacker...

Sql injection

SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter...

CVE-2018-7463

SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter...

CVE-2018-7463

SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter...

CVE-2018-7463

CVE-2018-7463 concerns ASANHAMAYESH CMS 3.4.6. The vulnerability lies in the files.php within the files component, where a remote attacker can inject SQL via the id parameter, potentially allowing arbitrary SQL execution. Multiple sources (NVD/NVDC CNVD entry) confirm the affected product and the...

CVE-2017-18194

SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker to execute arbitrary SQL commands via the "utype" parameter...

CVE-2017-18194

HamayeshNegar CMS is affected in its signup component (users/signup.php). The vulnerability is a SQL injection caused by the utype parameter, allowing a remote attacker to execute arbitrary SQL commands. The exploitation details are not provided in the documents; no patch or remediation steps are...

CVE-2015-5725

SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable...

CVE-2015-5725

SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable...

PT-2018-4403

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 2.2.4 Description The issue allows remote attackers to execute arbitrary SQL commands. This is due to a SQL injection vulnerability in the offset method in the Active Record class. The vulnerability can be exploit...

CVE-2016-10008

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the EXTSTRUCTUREdirection parameter...

CVE-2016-10008

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the EXTSTRUCTUREdirection parameter...

CVE-2016-10007

SQL injection vulnerability in the "Marketing Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the EXTFORMHANDLERorderBy parameter...

Sql injection

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the EXTSTRUCTUREdirection parameter...