664 matches found
CVE-2021-25647
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...
CVE-2021-25647
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...
Cross site scripting
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...
CVE-2021-25647
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...
Testesdecodigogratis Testes de Codigo Cross-Site Scripting Vulnerability
Testesdecodigogratis Testes de Codigo is a mobile application from Testesdecodigogratis Portugal that provides users with driver's license learning. A cross-site scripting vulnerability exists in Testesdecodigogratis Testes de Codigo v11.3 and prior that allows storing the "Feedback" message fiel...
The vulnerability in the vManage web interface of the programmatically defined Cisco SD-WAN network allows a attacker to modify records in certain database tables.
The vulnerability in the vManage web interface of the Cisco SD-WAN program-defined network relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to modify records in certain database tables remotely...
VulnCheck KEV: CVE-2020-5722
Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root...
PT-2019-15902 · Zoho · Zoho Manageengine Applications Manager
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Applications Manager versions prior to 13640 Description: The issue allows for a remote authenticated SQL injection attack. This is achieved via the agentid parameter in the Agent servlet, which affects the Agent.java proces...
OpenSNS SQL Injection Vulnerability
OpenSNS is a Comprehensive Social Software developed by Thinking Sky Technology. A SQL injection vulnerability exists in OpenSNS 6.1.0. An attacker can exploit this vulnerability by using the index.php?s=/ucenter/Config/ uid parameter to perform a SQL injection attack...
EulerOS Virtualization 3.0.1.0 : mariadb (EulerOS-SA-2019-1554)
According to the versions of the mariadb packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before...
CVE-2019-3906
Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents...
MariaDB 10.0.0 < 10.0.37 Multiple Vulnerabilities
The version of MariaDB installed on the remote host is prior to 10.0.37. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.37 advisory. - The crc32big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors...
UBUNTU-CVE-2018-13447
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter...
CVE-2018-1075
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step...
CVE-2018-1075
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step...
CVE-2018-8824
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function calls in the code parameter...
CVE-2018-7734
Afian FileRun before 2018.02.13 suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request...
CVE-2017-16540
OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...
Code injection
OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...
Article Directory Script SQL Injection Vulnerability
Article Directory Script is a script for creating article directories in websites. A SQL injection vulnerability exists in Article Directory Script version 3.0. A remote attacker can exploit this vulnerability by sending the 'id' parameter to the author.php or category.php file to inject SQL...