SQL Injection Vulnerability in iCMS v7.0.7 search.admincp.php Page

iCMS is a free, clean, efficient, and useful PHP content management system. iCMS v7.0.7 suffers from a SQL injection vulnerability in the search.admincp.php page, which originates from the orderby parameter being brought into the database for execution without any processing. An attacker can...

PT-2018-4642

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.7.2 dotCMS versions 4.x prior to 4.1.1 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the EXT FORM HANDLER orderBy parameter in the "Marketing...

CVE-2017-16864

The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the orderby parameter...

CVE-2017-16864: Improper Neutralization of Input During Web Page Generation

The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the orderby parameter...

PT-2018-6352

Name of the Vulnerable Software and Affected Versions: Atlassian Jira versions prior to 7.4.2 Description: The issue search resource in Atlassian Jira contains a cross site scripting XSS vulnerability in the orderby parameter, allowing remote attackers to inject arbitrary HTML or JavaScript...

WordPress Podlove Podcast Publisher SQL Injection Vulnerability

WordPress Podlove Podcast Publisher is a workflow-oriented solution for podcasters who want to save time and gain complete control over the integrity of their Podcast publishing process, published content, and published content. A SQL injection vulnerability exists in the orderby parameter in...

CVE-2017-12949: Improper Neutralization of Special Elements used in an SQL Command

lib\modules\contributors\contributorlisttable.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF...

PT-2017-12792

Name of the Vulnerable Software and Affected Versions Podlove Podcast Publisher plugin versions 2.5.3 and earlier Description The issue concerns SQL injection in the orderby parameter to 'wp-admin/admin.php', which is exploitable through CSRF. Recommendations For Podlove Podcast Publisher plugin...

CVE-2017-9299: Improper Neutralization of Input During Web Page Generation

Open Ticket Request System OTRS 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=XSS and Direction=XSS attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20 release, for example, is n...

PT-2017-18831

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.3.20 Description The issue concerns a Cross-Site Scripting XSS attack. Specifically, it affects index.pl requests with the Action=AgentStats parameter. The vulnerability can be exploited...

SQL Injection Vulnerability in Zendo 9.1.2 zentao\lib\base\dao\dao.class.php Page

Zendo is an open source project management software. Zendo project management software version 9.1.2 zentao\lib\base\dao\dao.class.php page SQL injection vulnerability. The orderBy function fails to filter the data submitted by the user, allowing an attacker to exploit the vulnerability to obtain...

PT-2017-7231

Name of the Vulnerable Software and Affected Versions Yeager CMS version 1.2.1 Description The issue allows local users to execute arbitrary SQL commands. This is achieved via the pagedir orderby parameter in the "yeager/y.php/tab USERLIST" endpoint. Recommendations For Yeager CMS version 1.2.1,...

CVE-2016-8906

SQL injection vulnerability in the "Site Browser Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8904

SQL injection vulnerability in the "Site Browser Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8904

SQL injection vulnerability in the "Site Browser Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8903

SQL injection vulnerability in the "Site Browser Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

Sql injection

SQL injection vulnerability in the "Site Browser HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

Sql injection

SQL injection vulnerability in the "Site Browser Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

Sql injection

SQL injection vulnerability in the "Site Browser Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

Sql injection

SQL injection vulnerability in the "Site Browser Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...