The vulnerability of the IBM DB2 database management system (including the IBM DB2 Connect server) arises from insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerability of the IBM DB2 database management system including the IBM DB2 Connect server exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending a specially crafted SQL query with the TRUNCA...

Cisco Identity Services Engine SQL Injection Vulnerability (CNVD-2019-23286)

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A SQL injection vulnerabilit...

Input validation

An issue was discovered in the D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL...

Elite Graphix Elite CMS Pro SQL Injection Vulnerability

Elite Graphix Elite CMS Pro is a lightweight PHP and MySQL based content management system from Elite Graphix India. A SQL injection vulnerability exists in the '?page=' parameter of the /admin/addsidebar.php file in Elite Graphix Elite CMS Pro version 2.01, which stems from a lack of validation ...

SQL Injection Vulnerability in Baines Network Certificate Lookup System

Baines Network Service Center is a company that mainly deals with official business websites, query systems, order management query systems and other items. Baines Network Certificate Query System has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database...

Open Faculty Evaluation System SQL Injection Vulnerability (CNVD-2019-18736)

Open Faculty Evaluation System is a PHP and MySQL based teacher evaluation system. The system provides Web-based graphical reports and Excel file reports, and supports student subject ratings for teachers. A SQL injection vulnerability exists in the submitfeedback.php file in Open Faculty...

CVE-2019-11768

An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature...

CVE-2019-12308

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

SQL injection vulnerability in Tpshop v3.5 Us***.php page (CNVD-2019-17501)

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the Tpshop v3.5 Us.php page. Attackers can use the vulnerability to obtain sensitive information in the database...

Carel pCOWeb < B1.2.1 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Carel pCOWeb - Stored XSS Exploit Author: Luca.Chiou Vendor Homepage: https://www.carel.com/ Version: Carel pCOWeb all versions prior to B1.2.1 Tested on: It is a proprietary devices: http://www.carel.com/product/pcoweb-car...

AUO Solar Data Recorder < 1.3.0 - addr Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: AUO Solar Data Recorder - Stored XSS Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO Solar Data Recorder all versions prior to v1.3.0 Tested on: It is a proprietary devices:...

Xionghai CMS has SQL injection vulnerability

XIONGHAI CMS is developed by XIONGHAI can be widely used in personal blogs, personal websites, corporate websites, a set of integrated website management system. XIONGHAI CMS has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in Vanno cms Backend c**_fe**.p** File

Vanno enterprise website management system is an asp + access for the development of asp enterprise website source code. Vanno cms background cfe.p file SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

AUO Solar Data Recorder 1.3.0 - addr Cross-Site Scripting

AUO Solar Data Recorder 1.3.0 - addr Cross-Site Scripting Exploit Title: AUO Solar Data Recorder - Stored XSS Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO Solar Data Recorder all versions prior to v1.3.0 Tested on: It is a proprietary devices...

PostgreSQL memory leak vulnerability (CNVD-2019-16482)

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features, such as foreign keys, triggers, views, and so on. There is a security vulnerability in PostgreSQL. An attacker can...

python-sqlalchemy: SQL Injection when the group_by parameter can be controlled

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

Scanners-Box

This is a collection of open-source scanning tools and wordlists for web application security testing. The repository, Scanners-Box, is a collection of tools from various contributors, including lijiejie, ringzero, and others. The tools are categorized into subdomains, database vulnerability...

Privilege Escalation

postgresql is vulnerable to privilege escalation vulnerability. Remote authenticated users could inject arbitrary code via database and role names with embedded special characters during administrative operations like pgdumpall...

Vulnerability in the Server component: The Oracle MySQL database management system’s options, which allow attackers to gain unauthorized access to server functions and data.

The vulnerability in the Oracle MySQL server component is related to user access control errors. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to the server’s functions and data...

Sql injection

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Input does not get validated and queries are not written in a way to prevent SQL injection. Therefore arbitrary SQL-Statements can be executed in the database...