WordPress Pie Register Blind SQL Injection

============================================= MGC ALERT 2018-004 - Original release date: May 10, 2018 - Last revised: June 11, 2018 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2018-10969 ============================================= I. VULNERABILITY...

CVE-2016-10550

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the "limit" or "order" parameters, a malicious user can put in their own SQL statements. This affects...

CVE-2016-10550

The CVE-2016-10550 issue affects sequelize (ORM for Node.js) where user input into limit or order parameters can be used to inject SQL. Concrete details across documents show affected version: 3.16.0 and earlier. Root cause is improper handling of input in query construction, enabling SQL stateme...

CVE-2016-10550: Improper Neutralization of Special Elements used in an SQL Command

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the limit or order parameters, a malicious user can put in their own SQL statements. This affects sequeliz...

Apache Fineract SQL Injection Vulnerability (CNVD-2018-09809)

Apache Fineract is a set of open source digital financial services platform of the U.S. Apache Apache Software Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. An SQL injection vulnerability...

Enhancesoft osTicket cross-site scripting vulnerability (CNVD-2018-07905)

Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A cross-site scripting vulnerability exists in the /scp/directory.php file in Enhancesoft osTicket versions prior to 1.10.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the...

Cross site scripting

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

CVE-2018-7193

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

CVE-2018-7193

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

CVE-2018-7193

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

CVE-2018-7193: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter...

PT-2018-17939

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.10.2 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the order parameter in the "/scp/directory.php" API endpoint...

WordPress WooCommerce Plugin Crafted Order XSS Vulnerability - Windows

WooCommerce Plugin for WordPress is prone to a cross-site scripting XSS vulnerability. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

PT-2018-17528 · Sangoma · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX versions 10.13.66-32bit and 14.0.1.24 SNG7-PBX-64bit-1712-2 Description: The issue allows post-authentication SQL injection via the order parameter. It is noted that the vendor disputes this issue, stating it is intentional for users ...

CVE-2018-6393: Improper Neutralization of Special Elements used in an SQL Command

FreePBX 10.13.66-32bit and 14.0.1.24 SNG7-PBX-64bit-1712-2 allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can "directly modify SQL tables ... or run shell scripts ... once ... logged in to the...

Easy Car Script SQL Injection Vulnerability

Easy Car Script is a set of online car category display scripts. A SQL injection vulnerability exists in the 2014 version of Easy Car Script. A remote attacker can exploit the vulnerability by sending the 'sorder' or 'srow' parameter to the sitesearch.php file to inject SQL commands...

WordPress WpJobBoard plugin SQL injection vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . WpJobBoard plugin is used in one of the job management plugin . A SQL injection vulnerability exists in WordPress...

Sql injection

Icy Phoenix 2.2.0.105 allows SQL injection via an unapprove request to adminkbart.php or the order parameter to adminjradmin.php, related to functionskb.php...

CVE-2018-5695

The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php...

PT-2018-17092

Name of the Vulnerable Software and Affected Versions: WpJobBoard plugin version 4.4.4 Description: The issue allows SQL injection via the order or sort parameter to the "wpjb-job" or "wpjb-alerts" module, with a request to "wp-admin/admin.php". Recommendations: For WpJobBoard plugin version 4.4....