CVE-2017-9427: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a crafted table name at admin/developer/modules/designer/ and the injection is...

CVE-2017-6557: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ArrayOS before AG 9.4.0.135, when the portal bookmark function is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-2555

SQL injection vulnerability in include/lib/mysqlconnect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php...

PT-2015-6530

Name of the Vulnerable Software and Affected Versions Drupal Spider Contacts module affected versions not specified Description A SQL injection issue in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to...

CVE-2014-4424

SQL injection vulnerability in Wiki Server in CoreCollaboration in Apple OS X Server before 2.2.3 and 3.x before 3.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-3773

CVE-2014-3773 concerns TeamPass prior to version 2.1.20, with multiple SQL injection vulnerabilities exposed through various parameters in the web interface. The affected components include sources/main.queries.php (login-related actions: send_pw_by_email, generate_new_password) and data handling...

Sql injection

SQL injection vulnerability in the getactivesession function in the KTAPIUserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function...

CVE-2013-7369

SQL injection vulnerability in an unspecified DLL in the FSDBCom ActiveX control in F-Secure Anti-Virus for Microsoft Exchange Server before HF02, Anti-Virus for Windows Servers 9.00 before HF09, Anti-Virus for Citrix Servers 9.00 before HF09, and F-Secure Email and Server Security and F-Secure...

Sql injection

SQL injection vulnerability in CSP MySQL User Manager 2.3 allows remote attackers to execute arbitrary SQL commands via the login field of the login page...

PT-2013-4369

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 7.1x through 9.12 Description A SQL injection issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For versions 7.1x through 9.12, update to a version that...

CVE-2012-6039

SQL injection vulnerability in viewcomments.php in YABSoft Advanced Image Hosting AIH Script, possibly 2.3, allows remote attackers to execute arbitrary SQL commands via the gal parameter...

Sql injection

SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter...

CVE-2012-5910

CVE-2012-5910 is a SQL injection in blogs/htsrv/viewfile.php of b2evolution 4.1.3. An authenticated remote user can inject SQL via the root parameter to execute arbitrary commands. Impact is partial confidentiality/integrity/availability as stated; attack vector is web-based with single-privilege...

CVE-2012-5327

Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 deleteusrgrp parameter in a deleteusergroups action, 2 usergroup paramete...

PT-2012-2819

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management version 7.5 Description A SQL injection issue allows remote authenticated users to execute arbitrary SQL commands. This affects products including SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli...

CVE-2012-3468

CVE-2012-3468 affects the Ushahidi Platform prior to 2.5. The vulnerability tier is high (CVSS v2 base score 7.5) and stems from multiple SQL injection weaknesses in specific code paths: (1) verify() in application/controllers/alerts.php, (2) save_all() in application/models/settings.php, and (3)...

CVE-2010-5103

SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-0980

SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter...

PT-2011-1012

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.1.0.7 through 11.2.0.4 Oracle Database Server version 12.1.0.1 Description The issue allows remote authenticated users to affect integrity via unknown vectors. Multiple vulnerabilities in the current Oracle...

PT-2011-1017

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 11.2.0.4 through 12.1.0.1 Description The issue affects the confidentiality, integrity, and availability of the system. It allows remote authenticated users to exploit the vulnerability via unknown vectors...