321 matches found
CVE-2020-36003: Improper Neutralization of Special Elements used in an SQL Command
The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases...
PT-2020-17074
Name of the Vulnerable Software and Affected Versions Canto plugin version 1.3.0 for WordPress Description The issue allows an unauthenticated attacker to make a request to any internal and external server via the /includes/lib/detail.php endpoint with the subdomain variable set to SSRF. This...
CVE-2020-28976: Server-Side Request Forgery (SSRF)
The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF...
CVE-2020-25487
PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php...
Sql injection
PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php...
CVE-2020-25487
PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php...
CVE-2020-25487
The CVE-2020-25487 affects PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 . The vulnerability is an SQL Injection delivered via the endpoint zms/animal-detail.php , enabling manipulation of database queries. The source indicates the issue is tied to this endpoint; there is no av...
CVE-2020-25487: Improper Neutralization of Special Elements used in an SQL Command
PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php...
PT-2019-12141
Name of the Vulnerable Software and Affected Versions DDRT Dashcom Live versions prior to 2019-05-08 Description The issue is related to a lack of authentication in case-exporting components, allowing unauthorized access to claim details. By visiting easily guessable URLs, such as "exportpdf/all...
Find a Place CMS Directory 1.5 - SQL Injection
Exploit Title: Locations CMS 1.5 - SQL Injection Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: https://themerig.com/ Software Link: https://codecanyon.net/item/locations-multipurpose-cms-directory-theme/21098597 Version: 1.0 Category: Webapps Tested on:...
CVE-2017-17649
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter...
CVE-2017-17649: Improper Control of Generation of Code
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter...
PT-2017-14942
Name of the Vulnerable Software and Affected Versions Readymade Video Sharing Script version 3.2 Description The issue concerns HTML Injection via the comment parameter in the "single-video-detail.php" endpoint. Recommendations For Readymade Video Sharing Script version 3.2, consider restricting...
CVE-2017-17636
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter...
CVE-2017-17602
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php showid or view-product.php pid parameter...
Sql injection
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php showid or view-product.php pid parameter...
Sql injection
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter...
Sql injection
Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php reportvideos array parameter...
CVE-2017-17636
The CVE-2017-17636 entry concerns MLM Forced Matrix 2.0.9 with a SQL injection in news-detail.php using the newid parameter. The vulnerability is described as exploitable remotely without authentication, with impact on confidentiality, integrity, and availability (per CVSS metrics: CVSSv2 base 7....