CVE-2014-100031: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Ganesha Digital Library GDL 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in 1 download.php or 2 main.php...

CVE-2014-10023: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TopicsViewer 3.0 Beta 1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 editblock.php, 2 editcat.php, 3 editnote.php, or 4 rmvtopic.php in admincp/...

PT-2015-3648

Name of the Vulnerable Software and Affected Versions Maian Uploader version 4.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in the "admin/data files/move.php" endpoint. Recommendations For Maian Uploader version 4.0, avoi...

PT-2015-3676

Name of the Vulnerable Software and Affected Versions Taboada MacroNews version 1.0 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the id parameter in the news popup.php file. Recommendations For Taboada MacroNews version 1.0,...

PT-2015-3639

Name of the Vulnerable Software and Affected Versions Ganesha Digital Library GDL version 4.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the id parameter in the "download.php" or "main.php" API endpoints. Recommendations For Ganesha Digit...

PT-2015-3667

Name of the Vulnerable Software and Affected Versions TopicsViewer version 3.0 Beta 1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter to several API endpoints, including "edit block.php", "edit cat.php", "edit note.php", and...

e107 ' e107_admin/users.php 'Cross-Site Request Forgery Vulnerability'

E107 is an open source, free and based on PHP and MySQL content management system CMS of the United States E107 company. The system supports a variety of plug-in programs and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A cross-si...

PMB SQL Injection Vulnerability

PMB is a WEB-based application. The PMB catalog.php script fails to properly filter the id parameter, allowing remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain database data...

CVE-2014-9459

Cross-site request forgery CSRF vulnerability in the AdminObserver function in e107admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action...

CVE-2014-9457: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in classes/monodisplay.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the id parameter to catalog.php...

CVE-2011-5309

Cross-site scripting XSS vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2011-5309

Cross-site scripting XSS vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

PT-2015-3505

Name of the Vulnerable Software and Affected Versions Wikipad version 1.6.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the id parameter in the pages.php file. Recommendations For Wikipad version 1.6.0, avoid using the ...

CVE-2011-5309: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Sql injection

SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcodeproductstable action to wp-admin/admin-ajax.php...

PT-2014-8930

Name of the Vulnerable Software and Affected Versions Cart66 Lite plugin versions prior to 1.5.2 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the id parameter in a shortcode products table action to the "/wp-admin/admin-ajax.php"...

CVE-2014-9239: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the IPS Connect service interface/ipsconnect/ipsconnect.php in Invision Power Board aka IPB or IP.Board 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2014-9176

Cross-site scripting XSS vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to lp/index.php...

WordPress Sexy Squeeze Pages Plugin - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "ID" parameter to lp/index.php. Solution Update the plugin...