CVE-2018-19549

Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php...

Sql injection

Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid request to Dynamiccontenttags.php...

Default credentials

Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI...

CVE-2018-19552

Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid request to Dynamiccontenttags.php...

CVE-2018-19553

Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamiccontenttags.php...

CVE-2018-19552

Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid request to Dynamiccontenttags.php...

CVE-2018-19550

Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI...

CVE-2018-19551

Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php...

CVE-2018-19551

Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php...

Sql injection

Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php...

CVE-2018-19550

Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI...

CVE-2018-19549

Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php...

CVE-2018-19549

Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php...

CVE-2018-19553

Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamiccontenttags.php...

CVE-2018-19551

Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php...

CVE-2018-19551

CVE-2018-19551 affects Interspire Email Marketer up to version 6.1.6, where a SQL injection exists in the checkduplicatetags tagname request handled by Dynamiccontenttags.php. The root cause is unsafe handling of input leading to arbitrary SQL execution by a remote attacker. The impact described ...

CVE-2018-19550

Interspire Email Marketer up to v6.1.6 is affected: the surveys_submit.php operation for creating/submitting surveys allows arbitrary file uploads, resulting in a PHP file being accessible under admin/temp/surveys/. Public exploit details (e.g., PacketStorm) demonstrate remote code execution via ...

CVE-2018-19552

Interspire Email Marketer up to version 6.1.6 is affected by a SQL Injection in the Dynamiccontenttags.php file through the deleteblock blockid[] parameter. The root cause is improper handling of user-supplied input enabling unauthorized SQL command execution, with impact on confidentiality, inte...

CVE-2018-19549

Interspire Email Marketer up to version 6.1.6 is affected by a SQL Injection via the tagids Delete action in Dynamiccontenttags.php. Root cause is improper handling of tagids in the delete-tags flow, enabling arbitrary SQL execution with partial/high impact to confidentiality, integrity, and avai...

CVE-2018-19552

Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid request to Dynamiccontenttags.php...