PT-2018-11327

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.18.0 Description The issue allows remote attackers to bypass intended access restrictions or conduct SSRF attacks due to unauthenticated requests to the websocket endpoint with an unvalidated id query parameter fo...

iCMS SQL Injection Vulnerability (CNVD-2018-14361)

iCMS is a content management system CMS built with PHP and MySQL databases. A SQL injection vulnerability exists in the spider.admincp.php file in iCMS version 7.0.8. A remote attacker can exploit this vulnerability by sending an app=spider&do=batch request with the 'id' parameter to the...

CVE-2018-12498

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...

Synology Calendar Improper Authorization Vulnerability

Synology Calendar is a file protection program from Synology that runs on Synology NAS devices. An authorization issue vulnerability exists in SYNO.Cal.Event in Synology Calendar. A remote attacker can exploit this vulnerability to create arbitrary events with the 'calid' or 'originalcalid'...

PT-2018-11218

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.8 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the id parameter in an "app=spider&do=batch" request to the "admincp.php" endpoint. Recommendations For iCMS version 7.0.8, avoid using th...

CVE-2018-12498: Improper Neutralization of Special Elements used in an SQL Command

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php...

Dimofinf CMS Cross-Site Scripting Vulnerability

Dimofinf CMS is an Arabic content management system CMS written in PHP. A cross-site scripting vulnerability exists in the news.php file in Dimofinf CMS version 3.0.0. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML with the help of the 'id' paramete...

CVE-2018-12094

Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2018-12094

Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2018-12094: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

PT-2018-11007

Name of the Vulnerable Software and Affected Versions Dimofinf CMS version 3.0.0 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the id parameter in the news.php file. Recommendatio...

Quest KACE System Management Appliance SQL Injection Vulnerability

Quest KACE System Management Appliance is an IT asset management appliance from Quest Software, USA. A SQL injection vulnerability exists in the '/common/runreport.php' script in version 8.0.318 of the Quest KACE System Management Appliance, which stems from the program not filtering incoming...

CVE-2018-10759

PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter...

CVE-2018-10759

PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter...

CVE-2018-10759

PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter...

CVE-2018-8914

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...

CliqueMania loja virtual SQL injection vulnerability

CliqueMania loja virtual is an online virtual store system. A SQL injection vulnerability exists in CliqueMania loja virtual version 14. A remote attacker can exploit this vulnerability to execute SQL commands with the 'id' parameter...

CVE-2018-10283

CliqueMania loja virtual 14 has SQL Injection via the patch/remote.php id parameter in a recomendar action...

CVE-2018-10283: Improper Neutralization of Special Elements used in an SQL Command

CliqueMania loja virtual 14 has SQL Injection via the patch/remote.php id parameter in a recomendar action...