CVE-2015-1428

Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow 1 remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or 2 remote authenticated users to execute arbitrary SQL commands via the valueid parameter in a savevalue action to...

PT-2015-5281

Name of the Vulnerable Software and Affected Versions Sefrengo versions prior to 1.6.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to "backend/main.php" or remote authenticated users to execute arbitrary SQL commands via the...

CVE-2015-1428: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow 1 remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or 2 remote authenticated users to execute arbitrary SQL commands via the valueid parameter in a savevalue action to...

CVE-2015-0919

Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the 1 idcat or 2 idclient parameter to backend/main.php...

CVE-2015-0918

Cross-site scripting XSS vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php...

CVE-2015-0918: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php...

PT-2015-4969

Name of the Vulnerable Software and Affected Versions Sefrengo versions prior to 1.6.1 Description The issue allows remote administrators to execute arbitrary SQL commands. This is possible via the idcat or idclient parameter to the "backend/main.php" endpoint. Recommendations For versions prior ...

CVE-2015-0919: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the 1 idcat or 2 idclient parameter to backend/main.php...

PT-2015-4968

Name of the Vulnerable Software and Affected Versions Sefrengo versions prior to 1.6.1 Description A cross-site scripting XSS issue exists in the administrative backend, allowing remote attackers to inject arbitrary web script or HTML via the searchterm parameter to "backend/main.php"...