CVE-2018-1000890

FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application...

CVE-2018-1000630

Battelle V2I Hub 2.5.1 is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to /api/PluginStatusActions.php and /status/pluginStatus.php using the jtSorting or id parameter, which could allow the attacker to view, add, modify or delete...

SQL Injection Vulnerability in Purchase Frontend pr***.aspx Page of Purchase System

Purchase system Purchase is a purchasing management system features include: product requisitioning, warehousing, inventory counts, data reports and more. A SQL injection vulnerability exists in the front-end pr.aspx page of Purchase, which can be exploited by attackers to obtain sensitive...

SQL Injection Vulnerability in File System Profile Frontend ge***.aspx Page

The filing system Profile is an in-house employee management software. A SQL injection vulnerability exists in the front-end ge.aspx page of File System Profile, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in PHPSHE B2C Mall System v1.7ca***.php

PHPSHE B2C mall system is an online shopping mall system. The system supports express tracking, online chat, order evaluation and statistics. PHPSHE B2C Mall System v1.7ca.php has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Zoho ManageEngine OpManager SQL Injection Vulnerability (CNVD-2018-26464)

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A SQL injection vulnerability exists in the Alarms section of ZOHO ManageEngine OpManager prior to version 12.3 build 123239. A remote attacker can exploit this vulnerability to execute...

WeBid SQL Injection Vulnerability (CNVD-2019-43415)

WeBid is an open source auction site building solutions. A SQL injection vulnerability exists in the yourauctions.php script in WeBid 1.2.2 and earlier versions. A remote attacker can exploit this vulnerability by sending an HTTP request to read the database...

SQL Injection Vulnerability in zzzphp sa***.php File

zzphp is a free website building system developed using PHP. A SQL injection vulnerability exists in the zzzphp sa.php file. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Shanghai Haitian Information Campus Informatization Platform suffers from SQL Injection Vulnerability

Shanghai Haitian Information System Engineering Co., Ltd. is a company dedicated to business research, product development, application consulting, project implementation, customer service, and industry alliance of management application software in the field of education and school. A SQL...

SQL Injection Vulnerability in Enzong Technology's Website Building System

Tianjin EnZhong Technology Development Co., Ltd. is a network application service operator and a top Internet industry solution company in China. There is a SQL injection vulnerability in EnZone's website building system, which can be exploited by attackers to obtain sensitive information from th...

CVE-2018-15719

Open Dental before version 18.4 ships with a MySQL database and uses default credentials of root with a blank password, enabling anyone on the network with access to the server to access all database information. Remediate by upgrading to version 18.4 or later (details in provided sources).

Code injection

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has...

DOUPHP has a file upload vulnerability

DouPHP is a lightweight enterprise website management system based on PHP+Mysql architecture, running on various platforms such as Linux, Windows, MacOSX, Solaris and so on. DOUPHP suffers from a file upload vulnerability. The vulnerability is caused by the website upload function failing to...

CVE-2018-0468

A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite CEMS could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default...

CVE-2018-0468

A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite CEMS could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default...

SQL Injection Vulnerability in emlog v6.0.0 Backend wi***.php Page

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. A SQL injection vulnerability exists in the emlog v6.0.0 backend wi.php page. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in D-link Central WifiManager Co***.php Page

D-LINK Central WifiManager CWM-100 is D-LINK centralized wireless management software. A SQL injection vulnerability exists in the D-LINK Central WifiManager Co.php page, which can be exploited by an attacker to gain access to database information and also modify or delete arbitrary database data...

SQL Injection Vulnerability in ShopSn v2.3.6 Official Version

ShopsN free version of the B2C e-commerce is a product of Shanghai Yisu Network Technology Co., Ltd. a full-featured enterprise-class commercial standards in line with the real allow free commercial use of open source online store full network system. ShopsN v2.3.6 official version of the existen...

SQL Injection Vulnerability in Yingtai's Website Builder System

Guilin Yingtai Business Co., Ltd. is an internet marketing service organization. There is a SQL injection vulnerability in the Yingtai Business website builder system, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Guotai Newpoint Public Resources Trading Platform

Jiangsu Guotai New Point Software Co., Ltd. is an informatization total solution provider, focusing on the fields of smart government, smart transaction, smart city park, construction industry and so on. A SQL injection vulnerability exists in Guotai Newpoint's public resources trading platform,...