CVE-2026-26990: Improper Neutralization of Special Elements used in an SQL Command

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly int...

SQL Injection

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to SQL Injection via the address parameter in the address-search.inc.php process. An authenticated attacker can extract...

RosarioSIS cross-site scripting vulnerability (CNVD-2020-42951)

RosarioSIS is a student information system for school management. A cross-site scripting vulnerability exists in RosarioSIS 6.7.2. The vulnerability stems from improper validation of user-supplied input in the Search.inc.php script. A remote attacker can exploit the vulnerability by using the...

CVE-2020-15717

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL...

CVE-2020-15717

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL...

CVE-2020-15717

RosarioSIS 6.7.2 is vulnerable to a client-side cross-site scripting (XSS) flaw caused by improper validation of user-supplied input in the Search.inc.php script. An attacker can exploit this by crafting a URL with the advanced parameter to execute script code in the victim’s browser within the s...

CVE-2020-15717: Improper Neutralization of Input During Web Page Generation

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL...

CVE-2012-1614: Exposure of Sensitive Information to an Unauthorized Actor

Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via 1 a direct request to plugins/visiblehookpoints/index.php, an invalid 2 page or 3 cat parameter to thumbnails.php, an invalid 4 page parameter to usermgr.php, or an invalid 5 newerthan or 6 oldertha...

Coppermine 1.5.18 Cross Site Scripting / Path Disclosure

waraxe-2012-SA081 - Multiple Vulnerabilities in Coppermine 1.5.18 ============================================================================== Author: Janek Vind "waraxe" Date: 29. March 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-81.html Affected Software: Coppermine is a...

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities

Author girex Homepage girex.altervista.org Date 31/05/2009 CMS Unclassified NewsBoard 1.6.4 and maybe lower Dork "This board is powered by the Unclassified NewsBoard software, 1.6.4" Multiple remote vulnerabilities 1 Remote SQL Injection php.ini regardless 2 Logs File Disclosure registerglobals =...

CVE-2006-3827: Undefined Security Weakness

SQL injection vulnerability in bmc/Inc/core/admin/search.inc.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the blog parameter...

CVE-2006-3827

The CVE-2006-3827 entry affects Kailash Nadh’s boastMachine (formerly bMachine) up to v3.1. The issue is an SQL injection in bmc/Inc/core/admin/search.inc.php, exploitable by remote authenticated administrators via the blog parameter. This is caused by unsanitized input being used in SQL queries,...

CVE-2006-3148: Undefined Security Weakness

SQL injection vulnerability, possibly in search.inc.php, in Open-Realty 2.3.1 allows remote attackers to execute arbitrary SQL commands via the sorttype parameter to index.php...

CVE-2005-3686: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.inc.php in Unclassified NewsBoard before 1.5.3 Patch 4 allows remote attackers to execute arbitrary SQL commands via the 1 DateFrom or 2 DateUntil parameter to forum.php...