PT-2018-17094

Name of the Vulnerable Software and Affected Versions: Icy Phoenix version 2.2.0.105 Description: The issue allows SQL injection via an unapprove request to "admin kb art.php" or the order parameter to "admin jr admin.php", related to "functions kb.php". Recommendations: For Icy Phoenix version...

SQL Injection in sequelize

Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 or later...

GHSA-XQG8-CV3H-XPPV SQL Injection in sequelize

Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 or later...

TUTUCMS system admin\Article.php page order parameter has SQL injection vulnerability

TUTUCMS is a set of CMS management program focusing on the development of image-based websites, using PHP+MYSQL architecture, which can run on different platforms Windows, Linux, Unix. A SQL injection vulnerability exists in the order parameter of the admin\Article.php page of the TUTUCMS system...

CVE-2015-8355: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the 1 order or 2 "by" parameter to admin/orion.extfeedbackformefbfforms.php...

Cross site scripting

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

UBUNTU-CVE-2017-6446

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

SQL Injection Vulnerability in Ocean CMS Order Parameter

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the adminnews.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'order' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the...

CVE-2017-6065

SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter...

CVE-2017-6065: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter...

PT-2017-16873

Name of the Vulnerable Software and Affected Versions GeniXCMS versions prior to 1.0.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the order parameter in the /inc/lib/Control/Backend/menus.control.php endpoint. Recommendations Fo...

CVE-2016-9134

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure...

PT-2016-7663

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue affects the "/expPaginator.php" endpoint, specifically the order parameter, allowing for SQL injection. This can lead to information disclosure. Recommendations For Exponent CMS version 2.3.9,...

CVE-2016-9134: Improper Neutralization of Special Elements used in an SQL Command

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure...

SQL Injection Vulnerability in TUTUCMS Order Parameter

TUTUCMS is a CMS image management system focused on the development of image-based websites. TUTUCMS x2.6 version has a SQL injection vulnerability, due to the system does not strictly filter order parameters, only the source code to do the corresponding code audit. Allow attackers to exploit the...

CVE-2016-3072

Multiple SQL injection vulnerabilities in the scopedsearch function in app/controllers/katello/api/v2/apicontroller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the 1 sortby or 2 sortorder parameter...

Red Hat Satellite SQL Injection Vulnerability

Red Hat Satellite is a suite of system management platforms from Red Hat, Inc. that can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A security vulnerability exists in the 'sortby' and 'sortorder' parameters...

SQL Injection

Overview Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 o...

Sql injection

Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow 1 remote attackers to execute arbitrary SQL commands via the device ID REST parameter PATHINFO to /ajax.php or 2 remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php...

CVE-2015-1514: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow 1 remote attackers to execute arbitrary SQL commands via the device ID REST parameter PATHINFO to /ajax.php or 2 remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php...