CVE-2019-25461 Web Ofisi Platinum E-Ticaret v5 SQL Injection via ajax/productsFilterSearch

Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' parameter. Attackers can send POST requests to the ajax/productsFilterSearch endpoint with malicious 'q' values using...

CVE-2019-25460

Affected software : Web Ofisi Platinum E-Ticaret v5. Vulnerability : SQL injection allowing unauthenticated attackers to manipulate queries via the 'q' GET parameter on the arama endpoint, using time-based techniques to extract data. Root cause / method : improper input handling enabling time-bas...

CVE-2019-25460

Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' GET parameter. Attackers can send requests to the arama endpoint with malicious 'q' values using time-based SQL...

CVE-2019-25455 Web Ofisi E-Ticaret v3 SQL Injection via ara.html

Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'a' parameter. Attackers can send GET requests to with malicious 'a' parameter values to extract sensitive database information...

CVE-2019-25455

Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability exploitable by unauthenticated attackers via the a parameter in ara.html. Attackers can manipulate database queries through crafted GET requests to extract sensitive information. The CVE specifies high impact with confidentiality leak...

CVE-2019-25455

Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'a' parameter. Attackers can send GET requests to with malicious 'a' parameter values to extract sensitive database information...

CVE-2019-25455: Improper Neutralization of Special Elements used in an SQL Command

Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'a' parameter. Attackers can send GET requests to with malicious 'a' parameter values to extract sensitive database information...

CVE-2019-25460: Improper Neutralization of Special Elements used in an SQL Command

Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' GET parameter. Attackers can send requests to the arama endpoint with malicious 'q' values using time-based SQL...

CVE-2019-25461: Improper Neutralization of Special Elements used in an SQL Command

Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' parameter. Attackers can send POST requests to the ajax/productsFilterSearch endpoint with malicious 'q' values using...

Web Office E-Ticaret SQL Injection Vulnerability

Web Ofisi E-Ticaret is an e-commerce system developed by the Turkish company Web Ofisi. The Web Ofisi E-Ticaret v3 version has a SQL injection vulnerability, which stems from insufficient input validation for the ‘a’ parameter. This vulnerability may lead to SQL injection attacks...

Web Office E-Ticaret SQL Injection Vulnerability

Web Ofisi E-Ticaret is an e-commerce system developed by the Turkish company Web Ofisi. Version 5 of Web Ofisi E-Ticaret has a SQL injection vulnerability. This vulnerability stems from insufficient input validation for the q parameter in the ajax/productsFilterSearch endpoint, which may lead to...

PT-2026-21448

Name of the Vulnerable Software and Affected Versions Web Ofisi Platinum E-Ticaret version 5 Description The software contains an SQL injection issue that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through the q parameter. They can send POST...

PT-2026-21442

Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'a' parameter. Attackers can send GET requests to with malicious 'a' parameter values to extract sensitive database information...

CVE-2025-15583

A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function getsafevalue of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be...

azureml-evaluate-mlflow (>=0.0.57, <=0.0.58), eensight (>=1.0.0, <=1.0.2) +6 more potentially affected by CVE-2026-2635 via mlflow (2.12.2)

mlflow PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.57, =1.0.0, =0.8.0, =0.0.6, =0.6.0.dev0, =0.10.0, =0.10.2 Source cves: CVE-2026-2635 Source advisory:...

CVE-2025-15582

A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2025-15583

A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function getsafevalue of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be...

CVE-2025-15583 detronetdip E-commerce function.php get_safe_value cross site scripting

A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function getsafevalue of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be...

CVE-2025-15583 detronetdip E-commerce function.php get_safe_value cross site scripting

A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function getsafevalue of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be...

CVE-2025-15582 detronetdip E-commerce Product Management Update authorization

A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The...