Joyent Node.js Sequelize SQL Injection Vulnerability

Joyent Node.js is the United States Joyent company's set of web applications built on Google V8 JavaScript engine on top of the platform. Sequelize is one of the database ORM object-relational mapping tool. A SQL injection vulnerability exists in Joyent Node.js Sequelize. A remote attacker can...

CVE-2015-1369

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2015-1369

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2015-1369: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...

PT-2015-5244

Name of the Vulnerable Software and Affected Versions sequelize versions prior to 2.0.0-rc8 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the order parameter when user input is passed into it. This can be exploited by manipulating the order...

Sql injection

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-6242: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-2303: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the file browser component wefs.php in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the 1 table or 2 order parameter...

PT-2014-4613

Name of the Vulnerable Software and Affected Versions webEdition CMS versions prior to 6.2.7-s1.2 webEdition CMS versions 6.3.x through 6.3.8 Description The issue concerns SQL injection vulnerabilities in the file browser component of webEdition CMS. These vulnerabilities allow remote attackers ...

Sql injection

Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a 1 getUploadPath or 2 getKBot SOAP request to service/kbotservice.php; the ID parameter to...

WordPress IndiaNIC FAQS Manager 1.0 SQL Injection

Exploit Title: WordPress IndiaNIC FAQ 1.0 Plugin Blind SQL Injection Google Dork: inurl:wp-content/plugins/faqs-manager Date: 21.03.2013 Exploit Author: m3tamantra http://m3tamantra.wordpress.com/blog Vendor Homepage: http://wordpress.org/extend/plugins/faqs-manager/ Software Link:...

CVE-2012-5341: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in statistik.php in Otterware StatIt 4 allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter, 2 show parameter in a stattld action, or 3 order parameter in a statabfragen action...

phpdisk old vulnerabilities in New usage and the background to get the SHELL way-vulnerability warning-the black bar safety net

Previous storms out through the pass to kill 0DAY The code is as follows /api/datacall. php? type=user&limit=1&order=1 andselect 1 fromselect count,concatselect select select concat0×2 7,0x7e,pdusers. username,0×2 7,0x7e,pdusers. password,0×2 7,0x7e from pdusers where userid=1 limit 0,1 from...

Code injection

The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP createfunction function...

CVE-2011-4453: Improper Control of Generation of Code

The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP createfunction function...

CVE-2011-4833: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the 1 where and 2 order parameters in a getfulllist action to index.php...

Traq 2.2 - Multiple SQL Injections Cross-Site Scripting

Traq 2.2 - Multiple SQL Injections Cross-Site Scripting source: https://www.securityfocus.com/bid/49835/info Traq is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow...

CVE-2009-4796: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 order and 2 direction parameters to search.php...

CVE-2009-4697: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in RadNICS Gold 5 allow remote attackers to inject arbitrary web script or HTML via the 1 order parameter in a ulist action and the 2 fid parameter in a viewforum action...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in BitScripts Bits Video Script 2.04 and 2.05 Gold Beta allows remote attackers to inject arbitrary web script or HTML via the order parameter...