SQL Injection Vulnerability in Kingdee Collaboration Office Platform (CNVD-2020-75010)

Kingdee Software China Co., Ltd. business scope includes: production, development, operation of computer hardware and software, technical training and information consulting services. A SQL injection vulnerability exists in the Kingdee Collaborative Office Platform, which can be exploited by an...

Ornose15 NewPK SQL Injection Vulnerability

Ornose15 Newpk is a Php-based blog management platform from the individual developers at Ornose15. NewPK 1.1 version exists SQL injection vulnerability, the vulnerability stems from the title parameter adminnewpost.php does not do effective filtering of user input, attackers can use this...

osquery Command Injection Vulnerability

osquery is a SQL-driven framework for operating system detection, monitoring and analysis. A command injection vulnerability exists in osquery versions prior to 4.6.0, which stems from the fact that by using additional predicates in sqlite, a person with osquery administrative access can read and...

Ornose15 Newpk SQL注入漏洞

Ornose15 Newpk is a Php-based blog management platform from the individual developers at Ornose15. NewPK 1.1 version exists SQL injection vulnerability, the vulnerability stems from the title parameter adminnewpost.php does not do effective filtering of user input, attackers can use this...

SQL Injection Vulnerability in Website Building System of Yuanqi Technology (Beijing) Co.

Ltd. was founded in May 2014, is committed to become a "private cloud-based service provider of a new generation of enterprise information management system". A SQL injection vulnerability exists in the website building system of Yuanqi Technology Beijing Co., Ltd, which can be exploited by...

SQL Injection Vulnerability in Xinhuo OA Office System (CNVD-2020-73398)

Xinhu OA office system is an open source online office system. SQL injection vulnerability exists in Xinhuo OA Office System. An attacker can exploit the vulnerability to obtain sensitive information in the database...

The vulnerability of the REST API interface of the Cisco IoT Field Network Director software, which allows a hacker to access the internal database of the vulnerable device.

The vulnerability of the REST API interface of the Cisco IoT Field Network Director software management tool is related to the lack of security measures for SQL query structures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the internal database of th...

SQL Injection Vulnerability in the Comprehensive Management Platform of Beijing Zhongcheng Kexin Technology Development Co. Ltd (CNVD-2020-70797)

Beijing Zhongcheng Kexin Technology Development Co., Ltd. is a travel whole industry chain service provider. A SQL injection vulnerability exists in the integrated management platform of Beijing Zhongcheng Kexin Technology Development Co. An attacker can exploit this vulnerability to obtain...

ZZCMS suffers from SQL injection vulnerability (CNVD-2020-70597)

ZZCMS is a content management system. A SQL injection vulnerability exists in the frontend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Golden Shop Worry Free Intelligent Shop Management System

Shenzhen to soft information technology limited company is committed to research and development gold store worry-free jewelry snack store management software series, to meet the needs of various types of jewelry retail store management software. Worry-free intelligent store management system SQL...

Jinan Yuxia Information Technology Co., Ltd. website building system suffers from SQL injection vulnerabilities (CNVD-2020-71666)

Jinan Yuxia Information Technology Co., Ltd. to the Internet products and related services as the main direction, is a collection of website construction and network promotion, IDC business, software development, server hosting, telecommunications value-added services and other integrated service...

Automattic: SQL Injection Union Based

Summary: Hello, I have found a SQL Injection Union Based on https://intensedebate.com/commenthistory/$YourSiteId The $YourSiteId into the url is vulnerable to SQL Injection. Steps to reproduce 1. Logging into https://intensedebate.com 2. After create your own site on...

SQL Injection Vulnerability in MetInfo Backend of Changsha Mito Information Technology Co.

MetInfo is an open source free CMS building system suitable for enterprise building. Changsha Mito Information Technology Co., Ltd. MetInfo backend has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2020-27662

CVE-2020-27662 affects GLPI with an Insecure Direct Object Reference (IDOR) in ajax/comments.php, allowing reading data from arbitrary tables (e.g., glpi_tickets, glpi_users) in versions prior to 9.5.3. The CVSS data lists a moderate base impact (C/L) with network access and low privileges requir...

SQL Injection Vulnerability in the Backend of Arsenal CMS (CNVD-2020-70791)

Jingxun CMS is a website construction and management system independently developed by Taizhou Jingxun Information Technology Co. A SQL injection vulnerability exists in the back-end of the CMS. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Automattic: [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.php

Summary Hello, i have found a SQLI Injection Time Based on https://www.intensedebate.com/changeReplaceOpt.php. The parameter $GET'acctid' is vulnerable. Detection I have inject a MySQL function sleep, and it works. GET /changeReplaceOpt.php?&opt=1&acctid=419523%20AND%20SLEEP15 HTTP/1.1 Host:...

UFIDA NC suffers from SQL injection vulnerability (CNVD-2020-69451)

UFIDA NC is a large erp enterprise management system and e-commerce platform. UFIDA NC suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to obtain sensitive information from the database...

SQL Injection Vulnerability in the Website Building System of Xiamen Intelligent Technology Co.

Ltd. is located in the beautiful scenery of the ancient city of Xi'an, Shaanxi Province, with a registered capital of 10 million yuan RMB, is a high-tech enterprise integrating development, manufacturing, sales and service. Ltd. building system there are SQL injection vulnerabilities, attackers c...

VMware VMWare SD-WAN Orchestrator SQL Injection Vulnerability

VMware VMWare SD-WAN Orchestrator is a software for orchestrating network data flows in a software-defined network architecture. A SQL injection vulnerability exists in VMware VMWare SD-WAN Orchestrator, which can be exploited by a remote attacker to submit a special SQL request to manipulate a...

Shijiazhuang Renaud Network Technology Co., Ltd. building system SQL injection vulnerability

Shijiazhuang Renaud Network Technology Co., Ltd. was founded in 2008, 12 years focusing on the application of Internet and information technology to help China's economic transformation and upgrading. Shijiazhuang Renaud Network Technology Co., Ltd. building system there are SQL injection...