eBrigade SQL Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple SQL Injection vulnerabilities product: eBrigade vulnerable version: =5.0 CVE number: CVE-2019-16743, CVE-2019-16744, CVE-2019-16745 impact: critical homepage:...

SQLiteManager 1.2.0 1.2.4 - Blind SQL Injection

SQLiteManager 1.2.0 1.2.4 - Blind SQL Injection !-- Exploit Title: Blind SQL injection in SQLiteManager 1.2.0 and 1.2.4 Date: 17-02-2019 Exploit Author: Rafael Pedrero Vendor Homepage: http://www.sqlitemanager.org/ Software Link: http://www.sqlitemanager.org/ Version: SQLiteManager 1.2.0 and 1.2....

CVE-2015-9330

The CVE-2015-9330 entry concerns the WordPress plugin wp-all-import, with a blind SQL injection vulnerability reported in versions before 3.2.5. Public sources (NVD, Red Hat, CNVD, CVE lists) consistently describe a SQL injection flaw in this plugin, aligned with a high/critical risk profile (CVS...

PT-2019-7289

Name of the Vulnerable Software and Affected Versions wp-all-import plugin versions prior to 3.2.5 Description The issue is related to blind SQL injection. Recommendations For versions prior to 3.2.5, update to version 3.2.5 or later to resolve the issue...

CVE-2015-9330: Improper Neutralization of Special Elements used in an SQL Command

The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection...

CVE-2019-1010034

Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" defined at databasecode.php line 1018 is vulnerable to a boolean-based blind sql injection. This function call can be triggered by...

CVE-2019-1010034

Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" defined at databasecode.php line 1018 is vulnerable to a boolean-based blind sql injection. This function call can be triggered by...

CVE-2019-1010034

WebLibrarian plugin for WordPress (Deepwoods Software) versions 3.5.2 and earlier are affected by a SQL Injection in the AllBarCodes function (database_code.php:1018). The vulnerability can be triggered by any logged-in user with at least Volunteer role or manage_circulation capabilities, potenti...

CVE-2019-1010034: Improper Neutralization of Special Elements used in an SQL Command

Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" defined at databasecode.php line 1018 is vulnerable to a boolean-based blind sql injection. This function call can be triggered by...

WordPress WP Statistics Plugin Blind SQL Injection

...

CVE-2019-13275

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

CVE-2019-13275: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

PT-2019-13229

Name of the Vulnerable Software and Affected Versions VeronaLabs wp-statistics plugin versions prior to 12.6.7 Description An issue was discovered in the plugin, where the "v1/hit" endpoint of the API is vulnerable to unauthenticated blind SQL Injection when the non-default "use cache plugin"...

WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection

An endpoint of the API, which is exposed when the 'use cache plugin' setting is enabled by default disabled, is vulnerable to an unauthenticated blind SQLi issue. time curl -X POST 'http://host/wp-json/wpstatistics/v1/hit' --data...

WebERP 4.15 - SQL injection Exploit

Exploit for php platform in category web applications Exploit Title: Blind SQL injection in WebERP. Exploit Author: Semen Alexandrovich Lyhin https://www.linkedin.com/in/semenlyhin/ Vendor Homepage: http://www.weberp.org/ Version: 4.15 A malicious query can be sent in base64 encoding to unseriali...

CVE-2018-5404

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges 'User Console Only' role to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. A...

CVE-2018-5404

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges 'User Console Only' role to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. A...

CVE-2018-5404

CVE-2018-5404 affects Quest Kace K1000 Appliance (KACE SMA) versions prior to 9.0.270. The vulnerability is a blind SQL injection in which an authenticated, low-privilege user ('User Console Only') could potentially retrieve sensitive data from the database or copy the entire database. The issue ...

PT-2019-10963

Name of the Vulnerable Software and Affected Versions: Quest Kace K1000 Appliance versions prior to 9.0.270 Description: The issue allows an authenticated, remote attacker with limited privileges to potentially exploit multiple Blind SQL Injection vulnerabilities. This could enable the attacker t...

KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Dell Kace Appliance Multiple Vulnerabilities Exploit Author: SlidingWindow, Twitter: @kapilkhot Vendor Homepage: https://www.quest.com/products/kace-systems-management-appliance/ Affected Versions: KACE SMA versions prior to...