WordPress zm-gallery plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in version 1.0 of the WordPress zm-gallery plugin. The vulnerability stem...

FlameCMS login.php file SQL injection vulnerability

FlameCMS is an open source PHP-based content management system CMS. A SQL injection vulnerability exists in the account/login.php file in FlameCMS version 3.3.5. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can...

Jobberbase SQL Injection Vulnerability

Jobberbase is an open source platform for building job search websites. A SQL injection vulnerability exists in Jobberbase version 2.0, which can be exploited by attackers to execute illegal SQL commands...

IBM DB2 High Performance Unload Elevation of Privilege Vulnerability

IBM DB2, etc. are products of IBM Corporation in the U.S.A. DB2 is a relational database management system.Opera Software Opera, etc. are products of Norway's Opera Software.Opera is a Web browser and IBM DB2 is a relational database management system. An elevation of privilege vulnerability exis...

SQL Injection Vulnerability in Teaching Quality Assurance System of Shanghai Shangding Software Technology Co.

The Teaching Quality Assurance System is a closed-loop management system that adopts a new business architecture and process handling model for the planning and initiation, execution and implementation, analysis and feedback of various teaching quality activities. Shanghai Shangding Software...

SQL Injection Vulnerability in Octave Volunteer Service Management System

Shangrao Octave Impression Technology Co., Ltd. is mainly engaged in Internet application system development and Internet operation consulting services. An SQL injection vulnerability exists in the Octave Volunteer Service Management System. An attacker can utilize the vulnerability to obtain...

PT-2019-9041 · Yandex · Clickhouse

Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 1.1.54131 Description: The issue is related to an incorrect configuration in the deb package, which could allow unauthorized use of the database. Recommendations: For versions prior to 1.1.54131, update to version...

mysql: InnoDB unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 8.0.16 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks...

IBM Sterling File Gateway SQL Injection Vulnerability

IBM Sterling File Gateway is a suite of file transfer software from IBM in the United States. The software integrates different centers of file transfer activity and facilitates the secure exchange of file-based data over the Internet. An SQL injection vulnerability exists in IBM Sterling File...

SQL Injection Vulnerability in MayiCMS

MayiCMS is a classified information system. MayiCMS suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to obtain sensitive information from the database...

The vulnerability of the IBM DB2 database management system (including the IBM DB2 Connect server) arises from insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerability of the IBM DB2 database management system including the IBM DB2 Connect server exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending a specially crafted SQL query with the TRUNCA...

Cisco Identity Services Engine SQL Injection Vulnerability (CNVD-2019-23286)

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A SQL injection vulnerabilit...

Input validation

An issue was discovered in the D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL...

Elite Graphix Elite CMS Pro SQL Injection Vulnerability

Elite Graphix Elite CMS Pro is a lightweight PHP and MySQL based content management system from Elite Graphix India. A SQL injection vulnerability exists in the '?page=' parameter of the /admin/addsidebar.php file in Elite Graphix Elite CMS Pro version 2.01, which stems from a lack of validation ...

SQL Injection Vulnerability in Baines Network Certificate Lookup System

Baines Network Service Center is a company that mainly deals with official business websites, query systems, order management query systems and other items. Baines Network Certificate Query System has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database...

Open Faculty Evaluation System SQL Injection Vulnerability (CNVD-2019-18736)

Open Faculty Evaluation System is a PHP and MySQL based teacher evaluation system. The system provides Web-based graphical reports and Excel file reports, and supports student subject ratings for teachers. A SQL injection vulnerability exists in the submitfeedback.php file in Open Faculty...

CVE-2019-11768

An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature...

CVE-2019-12308

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

SQL injection vulnerability in Tpshop v3.5 Us***.php page (CNVD-2019-17501)

Tpshop is a set of multi-merchant mode developed by Shenzhen Soleil Networks Limited mall system. A SQL injection vulnerability exists in the Tpshop v3.5 Us.php page. Attackers can use the vulnerability to obtain sensitive information in the database...

Carel pCOWeb < B1.2.1 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Carel pCOWeb - Stored XSS Exploit Author: Luca.Chiou Vendor Homepage: https://www.carel.com/ Version: Carel pCOWeb all versions prior to B1.2.1 Tested on: It is a proprietary devices: http://www.carel.com/product/pcoweb-car...