CVE-2018-12335

Incorrect access control in ECOS System Management Appliance aka SMA 5.2.68 allows a user to compromise authentication keys, and access and manipulate security relevant configurations, via unrestricted database access during Easy Enrollment...

CVE-2018-12335

CVE-2018-12335 affects ECOS System Management Appliance (SMA) 5.2.68. Root cause: improper access control allowing unrestricted database access during Easy Enrollment. Consequence: an attacker could compromise authentication keys and access/manipulate security-related configurations. Public detai...

CVE-2018-12335

Incorrect access control in ECOS System Management Appliance aka SMA 5.2.68 allows a user to compromise authentication keys, and access and manipulate security relevant configurations, via unrestricted database access during Easy Enrollment...

WordPress Plugin Ultimate Form Builder Lite < 1.3.7 - SQL Injection

Title: WordPress Ultimate Form Builder Lite Plugin getrow Vulnerable Variable: $POST'entryid' Vulnerable URL: http://vulnerablesite.com/wp-admin/admin-ajax.php Vulnerable POST body: entryid=ExploitCodeHere&wpnonce=xxx&action=ufblgetentrydetailaction Disclosure Timeline 2018/06/01 Vulnerabilities...

WordPress Plugin Google Map < 4.0.4 - SQL Injection

Title: WordPress Google Map Plugin getresults Vulnerable Variable: $GET'order' Vulnerable URL: http://vulnerablesite.com/wp-admin/admin.php?page=wpgmpmanagelocation&orderby=locationaddress&order=asc PROCEDURE ANALYSEEXTRACTVALUE4242,CONCAT0x42,BENCHMARK42000000,MD50x42424242,42 SQL injection...

WordPress Plugin Google Map 4.0.4 - SQL Injection

WordPress Plugin Google Map 4.0.4 - SQL Injection Title: WordPress Google Map Plugin getresults Vulnerable Variable: $GET'order' Vulnerable URL: http://vulnerablesite.com/wp-admin/admin.php?page=wpgmpmanagelocation&orderby=locationaddress&order=asc PROCEDURE...

SQL Injection Vulnerability in Website Building System of Guangdong Shunde Deyun Network Technology Co.

Guangdong Shunde Deyun Network Technology Co., Ltd. is a marketing company relying on the Internet, focusing on practical Internet planning and in-depth marketing. There is a SQL injection vulnerability in the website building system of Guangdong Shunde Deyun Network Technology Co. Attackers can...

WordPress Contact Form Maker Plugin 1.12.20 - SQL Injection Vulnerability

Exploit for php platform in category web applications Title: WordPress Contact Form Maker Plugin 1.12.20 - SQL Injection Author: Neven Biruski Software: WordPress Contact Form Maker plugin Software link: https://wordpress.org/plugins/contact-form-maker/ Version: 1.12.20 and below The easiest way ...

Feedy RSS News Ticker 'cat' SQL Injection Vulnerability

Feedy is a news courier for websites that are responsive to their users. An SQL injection vulnerability exists in Feedy RSS News Ticker 'cat'. An attacker can exploit the vulnerability to gain access to sensitive database information...

WordPress Plugin Contact Form Maker 1.12.20 - SQL Injection

WordPress Plugin Contact Form Maker 1.12.20 - SQL Injection Title: WordPress Contact Form Maker Plugin 1.12.20 - SQL Injection Date: 2018-06-07 Author: Neven Biruski Software: WordPress Contact Form Maker plugin Software link: https://wordpress.org/plugins/contact-form-maker/ Version: 1.12.20 and...

WordPress Plugin Contact Form Maker 1.12.20 - SQL Injection

Title: WordPress Contact Form Maker Plugin 1.12.20 - SQL Injection Date: 2018-06-07 Author: Neven Biruski Software: WordPress Contact Form Maker plugin Software link: https://wordpress.org/plugins/contact-form-maker/ Version: 1.12.20 and below The easiest way to reproduce the SQL injection...

WordPress Plugin Form Maker 1.12.24 - SQL Injection

Title: WordPress Form Maker Plugin 1.12.24 - SQL Injection Date: 2018-06-07 Author: Neven Biruski Software: WordPress Form Maker plugin https://wordpress.org/plugins/form-maker/ Version: 1.12.24 and below Vendor Status: Vendor contacted, update released The easiest way to reproduce the SQL...

NewsBee CMS 'download.php' SQL Injection Vulnerability

NewsBee CMS is a news website CMS Content Management System. A SQL injection vulnerability exists in NewsBee CMS 'download.php'. An attacker can exploit the vulnerability to obtain sensitive information from the database...

CVE-2018-1252 RSA Web Threat Detection SQL Injection Vulnerability

RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications. An authenticated malicious user with low privileges could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain...

Cloud EC E-commerce System v1.2 suffers from SQL Injection Vulnerability

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system v1.2 exists SQL injection vulnerability. An attacker can exploit the vulnerability t...

SQL Injection Vulnerability in SMiCMS Government Website System v201803224 Version

State Micro CMS is one of the mainstream CMS systems in China, and is also the largest open source platform provider in the field of PHP in Southern China. State Micro CMS government website system v201803224 version exists SQL injection vulnerability. Attackers can use the vulnerability to obtai...

SQL Injection Vulnerability in xycms Logistics and Transportation System v1.9

Jiangsu Xinyue Technology hereinafter referred to as "Xinyue Technology", a pioneer in the domestic website building industry, is a technology enterprise with independent intellectual property rights. xycms logistics and transportation company website building system v1.9 SQL injection...

CVE-2016-10551

waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's like, contains, startsWith, or endsWith will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in...

Hardcoded credentials

waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's like, contains, startsWith, or endsWith will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in...

CVE-2016-10551

waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's like, contains, startsWith, or endsWith will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in...