128 matches found
CVE-2018-19998
SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter...
CVE-2018-19995
A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to user/card.php...
CVE-2018-19998
SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter...
CVE-2018-19998
Dolibarr 8.0.2 contains a SQL injection in user/card.php via the employee parameter, allowing remote authenticated users to execute arbitrary SQL commands. This is reported across multiple feeds (NVD/OSV/CNVD), with CVSS scores up to 8.8 (HIGH) and impact on confidentiality, integrity, and availa...
CVE-2018-19994: Improper Neutralization of Special Elements used in an SQL Command
An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the desiredstock parameter...
CVE-2018-19998: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter...
CVE-2018-19995: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to user/card.php...
Sql injection
A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...
CVE-2018-17852: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...
SQL Injection
Dolibarr ERP/CRM is vulnerable to SQL injection attacks. An attacker is able to execute arbitrary SQL commands via the statutbuy in parameter in product/card.php...
SQL Injection
dolibarr/dolibarr is vulnerable to SQL Injection attacks. The application does not properly sanitize the statusbatch parameter in product/card.php, allowing a malicious user to inject and execute arbitrary SQL commands...
SQL Injection
dolibarr/dolibarr is vulnerable to SQL Injection attacks. The application does not properly sanitize the statutbuy parameter in product/card.php, allowing a malicious user to inject and execute arbitrary SQL commands...
SQL Injection
dolibarr/dolibarr is vulnerable to SQL Injection attacks. The application does not properly sanitize the statut parameter in product/card.php, allowing a malicious user to inject and execute arbitrary SQL commands...
CVE-2018-13448
Dolibarr ERP/CRM 7.0.3 is affected by an SQL injection in product/card.php via the country_id parameter, enabling remote arbitrary SQL execution. The issue is confirmed across multiple sources (NVD entry CVE-2018-13448, OSV/Ubuntu/Nessus references) and is categorized with a high/severe impact (C...
CVE-2018-13447: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter...
CVE-2018-13448: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the countryid parameter...
CVE-2018-13450: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statusbatch parameter...
CVE-2018-13449: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statutbuy parameter...
CVE-2017-9838
Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...