688 matches found
CVE-2016-8906
SQL injection vulnerability in the "Site Browser Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...
CVE-2016-8904
SQL injection vulnerability in the "Site Browser Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...
DedeCms use Csrf to create a file with the Execute sql statement getshell process with ideas-vulnerability warning-the black bar safety net
I from spring and autumn author: Szdny 00x01 ver. txt version 2 0 1 6 0 8 1 6 Due to the XAl3r submitted a patch day, so the latest version has been can not reproduce, so I specifically asked him to be a previous version of over to write this article ! Here is the Csrf trigger point, we create a...
miniMySQLAdmin 1.1.3 - Cross-Site Request Forgery (Execute SQL Query)
Exploit for php platform in category web applications document.forms.csrfpoc.submit; select from user order by User asc limit 20 Host User % exploituser1 -- 0day.today 2018-03-14...
los818 CMS SQL Injection Vulnerability
A sql injection vulnerability exists in los818 Content Management System, which allows remote attackers to execute their own sql commands on the web application or connect to dbms...
SQL Servers SQL Injection Characters Evasion Techniques
SQL injection techniques can allow remote attackers to execute SQL commands on SQL servers. Successful exploitation could allow attacker to disclose confidential information, modify or shut down the database or execute arbitrary code on affected servers...
CVE-2015-4634
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the localgraphid parameter...
CVE-2013-5957
Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the value parameter to 1 ajax/jqState or 2 ajax/jqcounty...
PT-2013-5162
Name of the Vulnerable Software and Affected Versions TYPO3 extension 'records' version 1.0.0 and earlier Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions 1.0.0 and earlier, at the moment, there is no information about a new...
CVE-2011-4674
SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the onlyhostid parameter...
CVE-2008-6810
CVE-2008-6810 affects Venalsur Booking Centre Booking System for Hotels Group 2.01. The vulnerability is multiple SQL injection in admin/checklogin.php, exploitable via the myusername (username) and password parameters, enabling remote SQL command execution as reported. The issue is documented wi...
CVE-2008-3669
SQL injection vulnerability in comments.php in ZeeScripts Reviews Opinions Rating Posting Engine Web-Site PHP Script aka ZeeReviews allows remote attackers to execute arbitrary SQL commands via the ItemID parameter...
CVE-2007-3652
SQL injection vulnerability in class/page.php in Farsi Script aka FaScript FaName 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this might be the same issue as CVE-2008-0328...
CVE-2007-6467
CVE-2007-6467 describes an SQL injection in MKPortal 1.1 RC1, specifically in index.php during the gallery foto_show action, exploitable via the ida parameter. The underlying issue is injectable SQL passed from user-controlled input, enabling remote attackers to execute arbitrary SQL commands. Th...
CVE-2006-3271
Multiple SQL injection vulnerabilities in Softbiz Dating 1.0 allow remote attackers to execute SQL commands via the 1 country and 2 sortby parameters in a searchresults.php; 3 browse parameter in b featuredphotos.php; 4 cid parameter in c products.php, d index.php, and e newsdesc.php...
CVE-2006-3275
SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded user parameter in a viewprofile action...
CVE-2006-3275
CVE-2006-3275 affects YaBB SE 1.5.5 and earlier, with a SQL injection in profile.php via a double-encoded user parameter in the viewprofile action. The underlying issue is a lack of proper input handling that allows remote attackers to execute SQL commands. Documented impact includes potential da...
CVE-2006-2827
SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed description" and "Search also in ISBN." NOTE: the vend...
CVE-2005-4349
SQL injection vulnerability in serverprivileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the 1 dbname and 2 checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to...