Sql injection

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the index.php username parameter...

CVE-2021-39377

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the index.php username parameter...

CVE-2021-40353

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...

Sql injection

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...

CVE-2020-20343: Cross-Site Request Forgery (CSRF)

WTCMS 1.0 contains a cross-site request forgery CSRF vulnerability in the index.php?g=admin&m=nav&a=addpost component that allows attackers to arbitrarily add articles in the administrator background...

CVE-2021-40353: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...

PT-2021-10479

Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0 Description: The issue is related to a cross-site request forgery CSRF vulnerability. This vulnerability is located in the "index.php?g=admin&m=nav&a=add post" component, which allows attackers to arbitrarily add articles in...

PT-2021-4493

Name of the Vulnerable Software and Affected Versions openSIS version 8.0 Description A SQL Injection issue exists, allowing a malicious attacker to issue SQL commands to the database through the username parameter in the "index.php" endpoint. This can enable a remote attacker to execute arbitrar...

CVE-2021-39377: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the index.php username parameter...

PT-2021-4504

Name of the Vulnerable Software and Affected Versions openSIS version 8.0 Description A SQL injection issue exists due to inadequate protection of the SQL query structure. This allows a remote attacker to execute arbitrary SQL commands using the USERNAME parameter in the "index.php" endpoint. The...

CVE-2020-19047

Cross Site Request Forgey CSRF in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?controller=system&action=admineditact'...

CVE-2020-19049: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

PT-2021-10276

Name of the Vulnerable Software and Affected Versions: iWebShop version 5.3 Description: The issue allows remote attackers to execute arbitrary code via a malicious POST request to the "/index.php?controller=system&action=admin edit act" API endpoint. This is a Cross Site Request Forgery CSRF...

CVE-2020-19705

thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add...

CVE-2020-19705

thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add...

CVE-2020-19705

CVE-2020-19705 affects the open‑source CMS component thinkphp-zcms . The vulnerability is a SQL injection achievable through the URL path /index.php?m=home&c=message&a=add, enabling arbitrary SQL execution. Documents do not provide specific affected versions, patch guidance, or exploit details be...

CVE-2020-19705: Improper Neutralization of Special Elements used in an SQL Command

thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add...

PT-2021-10393

Name of the Vulnerable Software and Affected Versions: thinkphp-zcms as of 20190715 Description: The issue allows SQL injection via the "index.php?m=home&c=message&a=add" API endpoint. This could potentially lead to unauthorized access to sensitive data. Recommendations: For thinkphp-zcms as of...

PT-2021-10186

Name of the Vulnerable Software and Affected Versions: Rukovoditel version 2.4.1 Description: A stored cross-site scripting XSS issue exists in the Name of application field on the General Configuration page, allowing remote attackers to inject arbitrary web script or HTML via a crafted website...

PT-2021-10184

Name of the Vulnerable Software and Affected Versions: qdPM version 9.1 Description: A Cross Site Scripting XSS issue exists in the Heading field found in the Login Page under the General menu. This can be exploited via a crafted website name by doing an authenticated POST HTTP request to "/qdPM...