CVE-2020-15714

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using the customLocation parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database...

LearnDash Plugin for WordPress < 3.1.6 SQL Injection

The WordPress LearnDash Plugin installed on the remote host is affected by a SQL Injection in the 'learndashgetcoursegroups' function in the ld-groups.php file due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queri...

Security Bulletin: Security vulnerability affects the Report Builder that is shipped with Jazz Reporting Service (CVE-2019-4651)

Summary There is a security vulnerability in the Report Builder shipped with Jazz Reporting Service. Vulnerability Details CVEID: CVE-2019-4651 DESCRIPTION: IBM Jazz Reporting Service JRS is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could...

PT-2020-18492 · Gila · Gila Cms

Name of the Vulnerable Software and Affected Versions: Gila CMS version 1.11.8 Description: The issue allows for SQL Injection through the /admin/sql endpoint with a query parameter. This can potentially lead to unauthorized access or manipulation of database content. Recommendations: For Gila CM...

CVE-2019-8140

An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database to transform uploaded JPEG file into a PHP file...

F5 BIG-IP AFM SQL Injection Vulnerability

F5 BIG-IP AFM is an advanced firewall product for protection against DDos attacks. F5 BIG-IP AFM suffers from a SQL injection vulnerability, which can be exploited by remote attackers to submit a special SQL request to manipulate a database, obtain sensitive information or execute arbitrary code...

Cisco Firepower Management Center Multiple SQLi (cisco-sa-20191002-fmc-sql-inj)

According to its self-reported version, Cisco Firepower Management Center is affected by multiple SQL injection SQLi vulnerabilities in the web-based management interface. These vulnerabilities exist due to improper validation of user-supplied input. A low-privileged, remote attacker can exploit...

Cisco Unified Intelligence Center Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client-side cross-site scripting XSS attack. The vulnerability occurs because...

LibreNMS SQL Injection Vulnerability (CNVD-2019-32210)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . An SQL injection vulnerability exists in ajaxrulesuggest.php in LibreNMS 1.50.1, which can be exploited by an authenticated attacker to corrupt database queries in order to extract or manipulate data...

CVE-2019-6827

A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System IGSS, Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated...

CVE-2019-6827

A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System IGSS, Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated...

Out-of-bounds

A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System IGSS, Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated...

CVE-2019-6827

A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System IGSS, Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated...

dotCMS 5.1.5: Exploiting H2 SQL injection to RCE

Impact The SQL injection vulnerability can be exploited as an unauthenticated attacker via CSRF or as a user of the role Publisher. An attacker is able to execute stacked SQL queries which means it is possible to manipulate arbitrary database entries and even execute shell commands when the H2...

phpMyAdmin prior to 4.8.6 SQLi vulnerablity (PMASA-2019-3)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is prior to 4.8.6. It is, therefore, affected by a SQL injection SQLi vulnerability that exists in designer feature of phpMyAdmin. An unauthenticated, remote attacker can exploit this to inje...

Sql injection

IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 155886...

SQL Injection Vulnerability in the Frontend of Worklog 25.0 System by Kaixin Worklog

Worklog is a B/S based software for structuring intra-enterprise collaborative work. A SQL injection vulnerability exists in the frontend of the Qixing Worklog 25.0 system, which can be exploited by attackers to manipulate the database...

SQL Injection Vulnerability in Sl***_St***.aspx of Bid 1.0 Backend of Qixing Engineering Bidding System

Qixing Bidding System is suitable for enterprises to collect information on government procurement, engineering construction, land grant and other bidding information, and to track the progress of works and payment of successful projects. QiStar Engineering Bidding System Bid 1.0 backend SlSt.asp...

SQL Injection Vulnerability in UsualToolCMS 8.0 Release Backend a_re***.php

UsualToolCMS UTCMS is a content management system and rapid site building framework. UsualToolCMS backend are.php suffers from a sql injection vulnerability, which can be exploited by attackers to manipulate the database...

SQL injection vulnerability in My***.aspx file in the background of Qixing intranet OA system

Qixing OA system formerly Qixing Portal system contains news, notifications, documents, gallery and process form content. A SQL injection vulnerability exists in the My.aspx file in the background of the Qixing Intranet OA System, which can be exploited by attackers to manipulate the database...