Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23890)

Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the /apps/apparticle/controller/editor.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the help of $POST'id'...

Niushop open source mall system Auth.php has sql injection vulnerabilities

NiuShop open source mall system , is by the Shanxi Niu Cool Information Technology Co., Ltd. completely independent design , research and development of a PHP open source e-commerce system . Niushop open source mall system Auth.php file parameters exist in the SQL injection vulnerability...

wstmall open source mall system userType parameters exist SQL injection vulnerability

WSTMall is a multi-commercial O2O open source system developed by Merchant Software based on thinkphp, is a system that can help businesses and individuals to quickly build a community service system. wstmall open source mall system userType parameter SQL injection vulnerability , because the...

SQL injection vulnerability in cms company.asp file id parameter

Tianjin Qihang enterprise station building cms is a website building system. SQL injection vulnerability exists in the id parameter of the company.asp file. An attacker can use this vulnerability to obtain sensitive information from the database...

Schneider Electric U.motion Builder track_getdata Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric U.motion Builder. No authentication is required to exploit this vulnerability. A remote code execution vulnerability exists in Schneider Electric U.motion Builder trackgetdata. T...

CVE-2017-4972

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release uaa-release 13.x versions prior to v13.12,...

CVE-2017-4972: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release uaa-release 13.x versions prior to v13.12,...

Joomla Payage component 'aid' parameter SQL injection vulnerability

Joomla is an open source, cross-platform content management system CMS developed using PHP and MySQL. A SQL injection vulnerability exists in the 'aid' parameter of the Joomla Payage component, which allows an attacker to exploit the vulnerability to gain access to sensitive database information...

SQL injection vulnerability in cid parameter of Fangfa CMS FcontentAction.class.php page

Fangfa CMS is a scalable web content management software. A SQL injection vulnerability exists in the cid parameter of the Fangfa CMS V4.0 FcontentAction.class.php page, which can be exploited by an attacker to obtain sensitive information from the database...

WordPress HDW Player Plugin SQL Injection Vulnerability

HDW Player is an application plugin available on the official WordPress Store that provides streaming media playback services. The WordPress HDW Player plugin suffers from a SQL injection vulnerability, which is exploited by attackers to read sensitive information in the database...

Subrion CMS SQL Injection Vulnerability

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A SQL injection vulnerability exists in the admin/database/ URI in Subrion CMS version 4.0.5.10. A remote...

PHPCMS 'index.php' page has SQL injection vulnerability

PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. PHPCMS 'index.php' page has a SQL injection vulnerability, which can be...

Joomla Eventix Events Calendar Component SQL Injection Vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla BookLibrary component. An attacker can exploit the vulnerability to access or modify database data...

Joomla J-CruiseReservation Standard Component SQL Injection Vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla J-CruiseReservation Standard component. An attacker can exploit the vulnerability to access or modify database data...

Joomla JomWALL component 'wuid' parameter SQL injection vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the 'wuid' parameter of the Joomla JomWALL component, which allows remote, unauthenticated attackers to execute arbitrary SQL commands via the parameter...

Joomla com_maxcomment component SQL injection vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla commaxcomment component. An attacker can exploit the vulnerability to access or modify database data...

SQL Injection Vulnerability in Ocean CMS v_name Parameter

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the adminajax.php page of Ocean CMS 6.46 utf-8 official version. The lack of filtering of the 'vname' parameter allows an attacker to exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in Ocean CMS zyapi.php Page

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the Ocean CMS zyapi.php page. The lack of filtering of the '$ids' parameter allows attackers to exploit the vulnerability to obtain sensitive information about the database...

CVE-2017-5598

An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

Serendipity 2.0.3: From File Upload to Code Execution

RIPS Analysis The analysis of Serendipity with RIPS took 67 seconds to complete. The total amount of issues is reasonable for a web application of this size. Most of the 36 low severe issues detected are information leakage issues, for example, when an error message leaks the DBMS system of a...