Arbitrary File Upload Vulnerability in Panavision OA System

Panavision OA Office System is a coordination office software. A SQL injection vulnerability exists in Panmicro OA Office System, which can be exploited by an attacker to obtain sensitive information from a website database...

Generic SQL Injection Vulnerability in CNGENETCMS v4.2.0

CNGENETCMS is a content management system CMS, there is an authentication bypass vulnerability CNGENETCMS v4.2.0 sp1. This vulnerability can be exploited to directly log in to the background of the site without authentication to manage the site. At present, many sites are still using this CMS...

Arab Portal SQL Injection Vulnerability

Arab Portal is a set of web portals. A SQL injection vulnerability exists in Arab Portal version 3, which stems from a failure of the members.php script to adequately filter the 'showemail' parameter in the signup operation. A remote attacker could use this vulnerability to execute arbitrary SQL...

WordPress WP Symposium Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL.WP Symposium is one of the social networking plug-ins. A SQL injection vulnerability exists in WordPress WP Symposium plugin...

Generalized SQL Injection Vulnerability in lm Parameters of Seven Colors Web Site Building System

Seven Colors Web Building System is a system that provides professional website building services. A generic SQL injection vulnerability exists in the lm parameter of the Seven Colors Network website builder system. Allow attackers to utilize commonly used SQL injection tools to obtain sensitive...

SQL Injection and Arbitrary File Upload Vulnerabilities in Rural Electronic Monitoring Platform of Beijing Zhongnong Xinda Information Technology Co.

Beijing Zhongnong Xinda Information Technology Co., Ltd. is a provider of comprehensive services for three rural informatization, and the Rural Electronic Monitoring Platform is one of the company's monitoring platforms. A SQL injection and arbitrary file upload vulnerability exists in the Rural...

WordPress SP Project & Document Manager plugin 'ajax.php' SQL injection vulnerability

WordPress is a blogging platform developed using the PHP language. The 'SP Project & Document Manager' plugin for WordPress suffers from a sql injection vulnerability in the implementation of 'ajax.php', which can be exploited by an attacker to take control of the application and perform...

SQL Injection Vulnerability in Panmicro E-office /E-mobile/create/ajax_do.php Parameters

Panmicro E-office is an OA product launched by Panmicro for small and medium-sized organizations. A SQL injection vulnerability exists in the Panmicro E-office /E-mobile/create/ajaxdo.php parameter, which can be exploited by an attacker to obtain sensitive information from the database...

Milw0rm Clone Script SQL Injection Vulnerability

Milw0rm is a hacking and defense interest group that provides security services such as vulnerability mining, security information, hacking and defense, security tools and other security services for IT technicians.Milw0rm Clone Script is a script for sharing and managing the Milw0rm website's...

Symantec Endpoint Protection Management Console SQL Injection Vulnerability

Symantec Endpoint Protection is a protection software developed to enhance enterprise virus protection and advanced threat defense. Symantec Endpoint Protection management console fails to properly validate user input and administrators with low privileges can perform SQL injection attacks with...

SQL injection vulnerability in txtContent parameter in InteractiveCommunication/InterActiveIndex.aspx of Wave Government Service Platform

Wave software government system is an industry informatization application system built on the basis of cloud computing and big data. There is a SQL injection vulnerability in the txtContent parameter of the InteractiveCommunication/InterActiveIndex.aspx of the Wave government service platform,...

Emerson AMS Device Manager Local SQL Injection Vulnerability

Emerson Electric AMS Device Manager is a fixed asset management software. The software provides predictive diagnostics, device configuration management, and more. An SQL injection vulnerability exists in AMS Device Manager 12.5 and earlier versions, which can be exploited by an attacker to gain...

Forma Lms SQL Injection Vulnerability

Forma Lms is an open source web-based learning management system LMS. A SQL injection vulnerability exists in Forma Lms, which allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain database data...

Drupal PHPlist Integration Module SQL Injection Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. phpList Integration is one of the modules that provides integration functionality between the Drupal website and the phpList Communication Manager. A SQL injection vulnerability exists...

JBoss RichFaces Arbitrary Code Execution Vulnerability

JBoss RichFaces is a Web framework with Ajax and JSF features . JBoss RichFaces handles do parameters with a security vulnerability that allows attackers to inject EL expressions and execute arbitrary java code...

RichFaces: Remote Command Execution via insufficient EL parameter sanitization

It was found that the 'do' parameter permitted expression language EL injection, which could allow a remote attacker to execute Java methods on an affected server...

Important: Red Hat Security Advisory: Red Hat JBoss Web Framework Kit 2.7.0 security update

An update for the RichFaces component of Red Hat JBoss Web Framework Kit 2.7.0 that fixes one security issue is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score...

SQL Injection Vulnerability in the Collaboration Management System/c6/Jhsoft.Web.login/NewView.aspx Page of Beijing Jinhe Network Co.

Beijing Jinhe Network Co., Ltd. collaborative management system, according to the precise management ideas guided by the 6C management concept design, the Internet technology, computer technology, Luan Runfeng's management concepts, Chinese culture, the four are closely integrated, the core of...

Cisco Secure Access Control System SQL Injection Vulnerability

Cisco Secure ACS is a central management platform for Cisco network devices that controls authentication and authorization of devices. A SQL injection vulnerability exists in the Cisco Secure Access Control System due to the program not adequately filtering user-supplied data before using it in S...

Red Hat CloudForms Management Engine SQL Injection Vulnerability

Red Hat CloudForms is hybrid cloud management software from Red Hat. A SQL injection vulnerability in Red Hat CloudForms Management Engine allows attackers to send specially crafted REST API requests to manipulate or obtain database data...