CVE-2021-26599

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26598

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers who are, by design, able to have a security token...

ImpressCMS SQL注入漏洞

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to a SQL injection vulnerability that stems from insufficient cleaning of user data passed in the groupps parameter of the...

ImpressCMS: Incorrect Authorization Checks in /include/findusers.php

Summary: The vulnerability is located in the /include/findusers.php script: 16. include "../mainfile.php"; 17. xoopsheaderfalse; 18. 19. $denied = true; 20. if !empty$REQUEST'token' 21. if icms::$security-validateToken$REQUEST'token', false 22. $denied = false; 23. 24. elseif isobjecticms::$user ...

Xoops SQL Injection Vulnerability

XOOPS eXtensible Object Oriented Portal System is XOOPS team development and maintenance of a set of open source based on PHP and MySQL content management system . A SQL injection vulnerability exists in Xoops' findusers.php page. Since the url parameter is not filtered for malicious characters, ...

CVE-2012-1603

Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the 1 curstr parameter in the findUsers function, 2 id parameter in the isIdAvailable function, or 3 username parameter in the getGreetings function...

Sql injection

Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the 1 curstr parameter in the findUsers function, 2 id parameter in the isIdAvailable function, or 3 username parameter in the getGreetings function...