395 matches found
UBUNTU-CVE-2017-6446
XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...
Cross site scripting
XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...
SQL Injection Vulnerability in Ocean CMS Order Parameter
Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the adminnews.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'order' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the...
SQL Injection Vulnerability in TUTUCMS Order Parameter
TUTUCMS is a CMS image management system focused on the development of image-based websites. TUTUCMS x2.6 version has a SQL injection vulnerability, due to the system does not strictly filter order parameters, only the source code to do the corresponding code audit. Allow attackers to exploit the...
CVE-2016-3072
Multiple SQL injection vulnerabilities in the scopedsearch function in app/controllers/katello/api/v2/apicontroller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the 1 sortby or 2 sortorder parameter...
Red Hat Satellite SQL Injection Vulnerability
Red Hat Satellite is a suite of system management platforms from Red Hat, Inc. that can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A security vulnerability exists in the 'sortby' and 'sortorder' parameters...
SQL Injection
Overview Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 o...
Sql injection
Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow 1 remote attackers to execute arbitrary SQL commands via the device ID REST parameter PATHINFO to /ajax.php or 2 remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php...
Joyent Node.js Sequelize SQL Injection Vulnerability
Joyent Node.js is the United States Joyent company's set of web applications built on Google V8 JavaScript engine on top of the platform. Sequelize is one of the database ORM object-relational mapping tool. A SQL injection vulnerability exists in Joyent Node.js Sequelize. A remote attacker can...
CVE-2015-1369
SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...
Sql injection
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...
Sql injection
Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a 1 getUploadPath or 2 getKBot SOAP request to service/kbotservice.php; the ID parameter to...
WordPress IndiaNIC FAQS Manager 1.0 SQL Injection
Exploit Title: WordPress IndiaNIC FAQ 1.0 Plugin Blind SQL Injection Google Dork: inurl:wp-content/plugins/faqs-manager Date: 21.03.2013 Exploit Author: m3tamantra http://m3tamantra.wordpress.com/blog Vendor Homepage: http://wordpress.org/extend/plugins/faqs-manager/ Software Link:...
phpdisk old vulnerabilities in New usage and the background to get the SHELL way-vulnerability warning-the black bar safety net
Previous storms out through the pass to kill 0DAY The code is as follows /api/datacall. php? type=user&limit=1&order=1 andselect 1 fromselect count,concatselect select select concat0×2 7,0x7e,pdusers. username,0×2 7,0x7e,pdusers. password,0×2 7,0x7e from pdusers where userid=1 limit 0,1 from...
Code injection
The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP createfunction function...
Traq 2.2 - Multiple SQL Injections Cross-Site Scripting
Traq 2.2 - Multiple SQL Injections Cross-Site Scripting source: https://www.securityfocus.com/bid/49835/info Traq is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow...
Cross site scripting
Cross-site scripting XSS vulnerability in search.php in BitScripts Bits Video Script 2.04 and 2.05 Gold Beta allows remote attackers to inject arbitrary web script or HTML via the order parameter...
CVE-2010-0365
Cross-site scripting XSS vulnerability in search.php in BitScripts Bits Video Script 2.04 and 2.05 Gold Beta allows remote attackers to inject arbitrary web script or HTML via the order parameter...