CVE-2017-14807: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects:...

PT-2020-8078

Name of the Vulnerable Software and Affected Versions: SUSE Studio onsite susestudio-ui-server versions 1.3.17-56.6.3 and prior versions Description: An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' issue allows remote attackers with admin privileges in Studio...

DEBIAN-CVE-2019-17357

Cacti through 1.2.7 is affected by a graphs.php?templateid= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, ...

CVE-2019-17357

Cacti through 1.2.7 is affected by a graphs.php?templateid= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, ...

EUVD-2019-7767

Cacti through 1.2.7 is affected by a graphs.php?templateid= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, ...

CVE-2019-17357: Improper Neutralization of Special Elements used in an SQL Command

Cacti through 1.2.7 is affected by a graphs.php?templateid= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, ...

CVE-2019-15625

A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information...

PT-2020-7038

Name of the Vulnerable Software and Affected Versions Simple Machine Forum SMF versions 1.0.4 and earlier Description The issue allows remote attackers to inject arbitrary SQL statements, which is a type of SQL injection vulnerability. This means an attacker can execute unauthorized SQL code on t...

F5 Networks BIG-IP : BIG-IP AFM SQL injection vulnerability (K21121741)

A vulnerability in the BIG-IP AFM Configuration utility may allow any authenticated BIG-IP user to run a SQL injection attack. CVE-2019-6658 Impact An attacker may be able to extract table name enumeration and user account names. All other data available through the injection is already available...

PT-2019-15934

Name of the Vulnerable Software and Affected Versions YetiShare version 3.5.2 Description The issue allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database. This is due to the direct insertion of values from the fileIds parameter into a SQL...

CVE-2019-19734: Improper Neutralization of Special Elements used in an SQL Command

accountmovefileinfolder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection...

Extracting Data from Smartphones

Privacy International has published a detailed, technical examination of how data is extracted from smartphones...

74cms 4.2.26 SQL Injection Vulnerability in Frontend Co***.php Page

Knight Talent System 74cms is a PHP + MYSQL based on the core development of a set of free + open source professional recruitment system. 74cms 4.2.26 SQL injection vulnerability exists in the frontend Co.php page. An attacker can exploit the vulnerability to obtain sensitive information from the...

CVE-2019-16285

If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive information onto a local drive...

Exploit for SQL Injection in Cisco Unified_Communications_Manager

CVE-2019-15972 Cisco UCM SQLi Scripts Scripts that can be used...

Server side request forgery (ssrf)

An XML external entities XXE vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks...

Sql injection

Authenticated SQL Injection in interface/forms/eyemag/js/eyebase.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter...

CVE-2019-16404

Authenticated SQL Injection in interface/forms/eyemag/js/eyebase.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter...

CVE-2019-16404: Improper Neutralization of Special Elements used in an SQL Command

Authenticated SQL Injection in interface/forms/eyemag/js/eyebase.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter...

PT-2019-14661

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.3 Description The issue allows a user to extract arbitrary data from the database via a non-parameterized INSERT INTO statement. This can be achieved by exploiting the providerID parameter in the interface/forms/e...