6676 matches found
CVE-2018-18795
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...
CVE-2018-18795
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...
PAYFORT payfort-php-SDK cross-site scripting vulnerability (CNVD-2019-08572)
PayFort is an online payment gateway. payfort-php-SDK is the PayFort payment gateway SDK. A cross-site scripting vulnerability exists in Amazon PAYFORT payfort-php-SDK on 2018-04-26 and earlier versions, which can be exploited by an attacker via the success.php fortid parameter to conduct a...
CCTV News App Has Arbitrary Account Login Vulnerability
CCTV News App is a portal news app software. CCTV News APP has an arbitrary account login vulnerability. Attackers can use this vulnerability to log into other people's accounts and obtain sensitive information by grabbing packets and modifying UID parameters...
Synology Photo Station Session Fixation Vulnerability
Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A session fixation vulnerability exists in SYNO.PhotoStation.Auth in Synology Photo Station versions prior to 6.8.7-3481, which can be exploited by remote attackers to hijack a web session with...
CVE-2018-18552
ServersCheck Monitoring Software through 14.3.3 allows local users to cause a denial of service menu functionality loss by creating an LNK file that points to a second LNK file, if this second LNK file is associated with a Start menu. Ultimately, this behavior comes from a Directory Traversal bug...
PHPSHE SQL Injection Vulnerability
PHPSHE is an online shopping mall system. The system supports express tracking, online chat, order evaluation and statistics. A SQL injection vulnerability exists in the admin.php?mod=user&act=del script in PHPSHE version 1.7. A remote attacker can exploit this vulnerability to execute arbitrary...
CVE-2018-18427
s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...
SQL Injection Vulnerability in Dscms
Dscms is an enterprise website builder based on TP5.0 framework development, using PHP + Mysql architecture. Dscms 0.1 version of the front-end SQL injection vulnerability, the vulnerability stems from the failure to filter the parameter $id, attackers can use the vulnerability to obtain sensitiv...
CVE-2018-17377
SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter...
CVE-2018-17375
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter...
CVE-2018-17375
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter...
Sql injection
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter...
Quest KACE Systems Management run_report SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Quest KACE Systems Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the ID parameter provided to the runreport page...
CVE-2018-16970
Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to download non-purchased course files via a modified id parameter...
CVE-2018-16971
Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to access non-purchased course contents quiz / test via a modified id parameter...
CVE-2018-16725
An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."...
CVE-2018-16361
An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter...