CVE-2017-15984: Improper Neutralization of Special Elements used in an SQL Command

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

PT-2017-14343

Name of the Vulnerable Software and Affected Versions Nice PHP FAQ Script affected versions not specified Description The issue allows SQL Injection via the nice theme parameter in index.php. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2017-16230

In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit...

PT-2017-14359

Name of the Vulnerable Software and Affected Versions Typecho versions prior to 1.1 Description The issue allows an attacker to log in to the background page, create a new article, and inject malicious payload into the article content, resulting in a cross-site scripting XSS attack via the...

CVE-2017-16230: Improper Neutralization of Input During Web Page Generation

In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit...

Sql injection

PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter...

Sql injection

iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php...

CVE-2017-15961

iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php...

CVE-2017-15970

PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter...

CVE-2017-15961

iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php...

CVE-2017-15970

PHP CityPortal 2.0 is vulnerable to SQL Injection through the nid parameter in index.php (page=news action) or the cat parameter. The issue is documented across multiple sources (NVD entry CVE-2017-15970, CNVD/CNVD-2017-35824, Exploit-DB/0day entries, etc.). Public proof-of-concept and exploit in...

PT-2017-14324

Name of the Vulnerable Software and Affected Versions PHP CityPortal version 2.0 Description The issue allows SQL Injection via the nid parameter to "index.php" in a "page=news" action, or the cat parameter. Recommendations For PHP CityPortal version 2.0, consider restricting access to the...

CVE-2017-16000: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacityperlabel/index.php...

PT-2017-14315

Name of the Vulnerable Software and Affected Versions iProject Management System version 1.0 Description The issue allows SQL Injection via the ID parameter to "index.php". Recommendations For iProject Management System version 1.0, avoid using the ID parameter in the "index.php" endpoint until t...

PT-2017-14320

Name of the Vulnerable Software and Affected Versions com zhyandexmap version 6.1.1.0 Description The issue allows SQL Injection via the placemarklistid parameter to the "index.php" endpoint. Recommendations For version 6.1.1.0, avoid using the placemarklistid parameter in the affected endpoint...

PT-2017-14353

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.1-0 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved by exploiting the graph parameter in the /module/capacity per label/index.php API endpoint...

CVE-2017-15961: Improper Neutralization of Special Elements used in an SQL Command

iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php...

CVE-2017-15970: Improper Neutralization of Special Elements used in an SQL Command

PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter...

CVE-2017-15966: Improper Neutralization of Special Elements used in an SQL Command

The Zh YandexMap aka comzhyandexmap component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php...

Sql injection

In the comtag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the tag parameter to index.php. The request method to execute is GET...