129 matches found
CVE-2019-3494: Improper Neutralization of Special Elements used in an SQL Command
Simply-Blog through 2019-01-01 has SQL Injection via the admin/deleteCategories.php delete parameter...
WampServer Cross-Site Scripting Vulnerability
WampServer is an integrated installation of Apache, Mysql and PHP for the Windows platform. A cross-site scripting vulnerability exists in WampServer version 3.1.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'virtualdel' parameter...
Xionghai CMS system delete parameter exists sql injection vulnerability
XIONGHAI CMS is developed by XIONGHAI can be widely used in personal blogs, personal websites, corporate websites, a set of integrated website management system. Applicable to personal blogs, personal websites, corporate websites and other various purposes, the front end of the computer, mobile t...
flatCore File Deletion Vulnerability
flatCore is a content management system based on PHP5 and SQLite3. A file deletion vulnerability exists in flatCore version 1.4.7, which allows an attacker to delete the acp/acp.php file by traversing the delete parameter...
PT-2017-18593
Name of the Vulnerable Software and Affected Versions flatCore version 1.4.7 Description The issue allows file deletion through directory traversal in the delete parameter to "acp/acp.php". The risk might be limited to requests submitted through CSRF. Recommendations For flatCore version 1.4.7,...
CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...
CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...
CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...
CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...
CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...
CVE-2017-5930: Missing Authorization
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...
CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...
phpmps member.php parameter delete from SQL injection vulnerability
0x01 vulnerability profile phpmps in the page member. php parameter delete since the filter is not strict, resulting in SQL injection vulnerability. 0x02 vulnerability details member.php in the delete logic the presence of injection vulnerabilities. 1The id parameter, as long as not an array it...
CVE-2012-3953: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...
PT-2012-5083
Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the delete parameter to the 'editattributes' page in 'admin/index.php'. Recommendations For versions...
WordPress Plugin Ajax Gallery 3.0 - SQL Injection
Exploit Title: WordPress Ajax Gallery plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0 --------------- Vulnerable code --------------- if isset $GET 'delete' && isset $GET'gId' $wpdb-query "DELETE FROM $wpdb-options WHERE optionname='agItem' and optionid=".$GET'gId' ; echo "Galeria...
Directory traversal
Directory traversal vulnerability in archive.php in TorrentVolve 1.4, when registerglobals is enabled, allows remote attackers to delete arbitrary files via a .. dot dot in the deleteTorrent parameter...
CVE-2008-6146: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via a delete parameter in a Delete action, a different vector than CVE-2005-2989...
Directory traversal
Directory traversal vulnerability in system/admin/images.php in LoveCMS 1.6.2 Final allows remote attackers to delete arbitrary files via a .. dot dot in the delete parameter...