GHSA-JC4V-VVG6-XG78 SQL Injection in ImpressCMS

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

SQL Injection in ImpressCMS

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26599

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26599

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

Sql injection

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26599

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26599

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26598

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers who are, by design, able to have a security token...

CVE-2021-26598

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers who are, by design, able to have a security token...

CVE-2021-26599: Improper Neutralization of Special Elements used in an SQL Command

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection...

CVE-2021-26598: Improper Authentication

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers who are, by design, able to have a security token...

PT-2022-9760

Name of the Vulnerable Software and Affected Versions ImpressCMS versions prior to 1.4.3 Description The issue is related to Incorrect Access Control in ImpressCMS, specifically in the include/findusers.php file, which allows access by unauthenticated attackers who have a security token by design...

ImpressCMS SQL Injection Vulnerability (CNVD-2022-30802)

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to a SQL injection vulnerability that stems from insufficient cleaning of user data passed in the groupps parameter of the...

ImpressCMS 1.4.2 SQL Injection Vulnerability

--------------------------------------------------------------- ImpressCMS getUserCountByGroupLink@$POST"groups", $criteria; 282. 283. $validsort = array"uname", "email", "lastlogin", "userregdate", "posts"; 284. $sort = !inarray$POST'usersort', $validsort ? "uname" : $POST'usersort'; 285. $order...

ImpressCMS 1.4.2 Incorrect Access Control Vulnerability

-------------------------------------------------------------------------- ImpressCMS validateToken$REQUEST'token', false 22. $denied = false; 23. 24. elseif isobjecticms::$user && icms::$user-isAdmin 25. $denied = false; 26. 27. if $denied 28. icmscoreMessage::errorNOPERM; 29. exit; 30. This...

ImpressCMS 1.4.2 SQL Injection

--------------------------------------------------------------- ImpressCMS getUserCountByGroupLink@$POST"groups", $criteria; 282. 283. $validsort = array"uname", "email", "lastlogin", "userregdate", "posts"; 284. $sort = !inarray$POST'usersort', $validsort ? "uname" : $POST'usersort'; 285. $order...

XOOPS 'findusers.php' SQL Injection Vulnerability

XOOPS is prone to an SQL injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xoops:xoops"; ifdescription...

CVE-2017-7290

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program...

Sql injection

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program...

CVE-2017-7290

SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program...