15263 matches found
PT-2018-3603
Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to "/accountancy/admin/accountmodel.php", "/accountancy/admin/categories list.php",...
Sql injection
SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...
openSUSE Security Update : phpMyAdmin (openSUSE-2018-387)
This update for phpMyAdmin to version 4.8.0.1 fixes the following issues : - CVE-2018-10188: Possible execution of arbitrary SQL statements via manipulated URLs boo1090309 This version also contains a number of upstream changes, improvements, new functions and bug fixes. %NASLMINLEVEL 70300 C...
CVE-2018-10188
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...
PT-2018-9741
Name of the Vulnerable Software and Affected Versions: phpMyAdmin version 4.8.0 Description: The issue allows an attacker to execute arbitrary SQL statements due to a CSRF problem, related to files such as js/db operations.js, js/tbl operations.js, libraries/classes/Operations.php, and sql.php...
CVE-2018-10188: Cross-Site Request Forgery (CSRF)
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...
CVE-2018-8734: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter...
SQL Injection
Dolibarr is vulnerable to SQL injection attacks. The attacks exist because it does not properly sanitize the viewstatut and propalstatut aka searchstatut parameters in comm/propal/list.php, allowing the authenticated user to inject arbitrary SQL code through it...
Code injection
The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql parameter. Consequently, an attacker can execute arbitrary PHP code by placing it after a ?php substring, and then using INTO OUTFILE wit...
CVE-2018-9247
The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql parameter. Consequently, an attacker can execute arbitrary PHP code by placing it after a ?php substring, and then using INTO OUTFILE wit...
CVE-2018-9247: Improper Neutralization of Special Elements used in an SQL Command
The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql parameter. Consequently, an attacker can execute arbitrary PHP code by placing it after a...
GxlcmsQY Arbitrary PHP Code Execution Vulnerability
Gxlcms QY is an enterprise website creation system. A security vulnerability exists in the 'upsql' function in the \Lib\Lib\Action\Admin\DataAction.class.php file in Gxlcms QY version 1.0.0713. A remote attacker can exploit this vulnerability by executing arbitrary SQL statements with the help of...
CVE-2018-8820
An issue was discovered in Square 9 GlobalForms 6.2.x. A Time Based SQL injection vulnerability in the "match" parameter allows remote authenticated attackers to execute arbitrary SQL commands. It is possible to upgrade access to full server compromise via xpcmdshell. In some cases, the...
Sql injection
DISPUTED SQL injection vulnerability in SQLiteDatabase.java in the SQLi Api in Android allows remote attackers to execute arbitrary SQL commands via the delete method...
CVE-2014-4959
Technical details about CVE-2014-4959 are not publicly provided in the included documents; no affected products, root cause, impact, or remediation are specified. Monitor for updates.
PT-2018-4231
Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A disputed SQL injection issue in SQLiteDatabase.java within the SQLi Api allows remote attackers to execute arbitrary SQL commands via the delete method. Recommendations At the moment, there...
CVE-2018-8802
SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...
CVE-2018-8802
SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...