CVE-2019-20361

There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability...

PT-2020-10397 · Unknown · Email Subscribers & Newsletters

Name of the Vulnerable Software and Affected Versions: Email Subscribers & Newsletters versions prior to 4.3.1 Description: The issue is related to a blind SQL injection vulnerability. It allowed SQL statements to be passed to the database in the hash parameter. Recommendations: For versions prio...

CVE-2019-20361: Improper Neutralization of Special Elements used in an SQL Command

There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability...

CVE-2018-1999019: Improper Control of Generation of Code

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This...

CVE-2013-3536: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the gpLoadUserFromHash function in functionshash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter...

WHMCS Group Pay Plugin 1.5 (grouppay.php, hash param) - SQL Injection

We have found a SQL injection inside the group pay plugin for WHCMS. A lot of game hosting companies are using this plugin. SQL Injection is in the function gpLoadUserFromHash. Exploits ============ - SQL Injection grouppay.php?hash=%hash%' and '1'='1 ============ Code SQL Injection ============...

CVE-2012-4996

Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL commands via the hash parameter to 1 dltorrent.php or 2 torrentfunctions.php...

CVE-2012-4996: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL commands via the hash parameter to 1 dltorrent.php or 2 torrentfunctions.php...

PT-2009-4565 · Fretsweb · Fretsweb

Name of the Vulnerable Software and Affected Versions: FretsWeb version 1.2 Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the name parameter to "player.php" and the hash parameter to "song.php". Recommendations: For FretsWeb version 1.2...

CVE-2008-6596: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL commands via the hash parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in signme.inc.php in Planetluc SignMe 1.5 before 1.55 allows remote attackers to inject arbitrary web script or HTML via the hash parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-4891: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in signme.inc.php in Planetluc SignMe 1.5 before 1.55 allows remote attackers to inject arbitrary web script or HTML via the hash parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-0723: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mynews.inc.php in MyNews 1.6.4, and other earlier 1.6.x versions, allows remote attackers to inject arbitrary web script or HTML via the hash parameter in an admin action to index.php, a different vulnerability than CVE-2006-2208.1...

CVE-2006-2208

Multiple cross-site scripting XSS vulnerabilities in mynews.inc.php in MyNews 1.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 hash and 2 page parameters...

CVE-2006-2208

Multiple cross-site scripting XSS vulnerabilities in mynews.inc.php in MyNews 1.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 hash and 2 page parameters...

PT-2006-3182 · Mynews · Mynews

Name of the Vulnerable Software and Affected Versions: MyNews version 1.6.2 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the hash and page parameters. Recommendations: For...