PT-2018-15003

Name of the Vulnerable Software and Affected Versions arcms through 2018-03-19 Description An issue exists in the software due to SQL injection via the limit parameter in the json/newslist endpoint. This is caused by files ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php...

FHCRM SQL Injection Vulnerability

FHCRM is a free and open source product management system based on ThinkPHP and Extjs. FHCRM 2018-02-11 and previous versions of the existence of SQL injection vulnerability, the attacker can index.php/User/read limit parameter to exploit the vulnerability to execute arbitrary SQL commands...

CVE-2018-16354

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

CVE-2018-16353

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter...

CVE-2018-16354

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

Sql injection

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

CVE-2018-16353

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter...

CVE-2018-16354

CVE-2018-16354 affects FHCRM (free/open source product management system). The connected CNVD/CVE records describe a SQL injection vulnerability exposed by the index.php/User/read limit parameter, with attackers potentially executing arbitrary SQL commands. FHCRM versions up to 2018-02-11 are imp...

CVE-2018-16353: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter...

CVE-2018-16354: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

PT-2018-13512

Name of the Vulnerable Software and Affected Versions FHCRM versions prior to 2018-02-11 Description An issue was discovered that allows SQL injection via the "/index.php/Customer/read" API endpoint, specifically through the limit parameter. Recommendations For versions prior to 2018-02-11,...

PT-2018-13513

Name of the Vulnerable Software and Affected Versions FHCRM versions prior to 2018-02-11 Description An issue was discovered that allows SQL injection via the limit parameter in the "index.php/User/read" endpoint. Recommendations For versions prior to 2018-02-11, consider restricting access to th...

CVE-2016-9490

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

CVE-2016-10550

The CVE-2016-10550 issue affects sequelize (ORM for Node.js) where user input into limit or order parameters can be used to inject SQL. Concrete details across documents show affected version: 3.16.0 and earlier. Root cause is improper handling of input in query construction, enabling SQL stateme...

CVE-2016-10550

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the "limit" or "order" parameters, a malicious user can put in their own SQL statements. This affects...

CVE-2016-10550: Improper Neutralization of Special Elements used in an SQL Command

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the limit or order parameters, a malicious user can put in their own SQL statements. This affects sequeliz...

UBUNTU-CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

CVE-2016-10204

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

CVE-2016-10204: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php...

PT-2017-7802

Name of the Vulnerable Software and Affected Versions Zoneminder versions 1.30 and earlier ALT Linux affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the limit parameter in a log query request to "index.php"...