Sql injection

SQL injection vulnerability in remotereporter/loadlogfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to execute arbitrary SQL commands via the server parameter...

PT-2020-7782

Name of the Vulnerable Software and Affected Versions: Netsweeper versions 3.1.10 and earlier Netsweeper versions 4.0.x through 4.0.8 Netsweeper versions 4.1.x through 4.1.1 Description: The issue allows remote attackers to execute arbitrary SQL commands via the server parameter in the...

CVE-2014-9612: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in remotereporter/loadlogfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to execute arbitrary SQL commands via the server parameter...

Prima FlexAir Access Control 2.3.38 - Remote Code Execution Exploit

Exploit for hardware platform in category web applications Exploit Title: Prima FlexAir Access Control 2.3.38 - Remote Code Execution Exploit Author: LiquidWorm Vendor Homepage: https://www.primasystems.eu/ Software Link: https://primasystems.eu/flexair-access-control/ Version: 2.3.38 Tested on: ...

WordPress api-bearer-auth plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. api-bearer-auth is used in one of the REST API authentication plugin. A cross-site scripting vulnerability exists in versions of t...

CVE-2019-16332

In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS...

CVE-2019-16332: Improper Neutralization of Input During Web Page Generation

In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS...

CVE-2019-9122

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntpserver parameter in an ntpsync.cgi POST request...

PT-2019-6344 · D Link · D-Link Dir-825

Name of the Vulnerable Software and Affected Versions: D-Link DIR-825 versions 2.10 Description: The issue is related to the lack of input validation in the firmware of D-Link DIR-825 routers. This can be exploited by a remote attacker to execute arbitrary commands by sending a specially crafted...

TOTOLINK A3002RU System Command Injection Vulnerability (CNVD-2018-26643)

TOTOLINK A3002RU is a wireless router product from Gion Electronics TOTOLINK. A command injection vulnerability exists in fromNtp in TOTOLINK A3002RU version 1.0.8. An attacker can exploit this vulnerability to execute system commands with the help of the 'ntpServerIp2' POST parameter...

Design/Logic Flaw

Adminer through 4.3.1 has SSRF via the server parameter...

UBUNTU-CVE-2018-7667

Adminer through 4.3.1 has SSRF via the server parameter...

DEBIAN-CVE-2018-7667

Adminer through 4.3.1 has SSRF via the server parameter...

CVE-2018-7667

Adminer through 4.3.1 has SSRF via the server parameter...

EUVD-2021-0529

Adminer through 4.3.1 has SSRF via the server parameter...

CVE-2018-7667

Adminer through 4.3.1 has SSRF via the server parameter...

Adminer Server-Side Request Forgery Vulnerability

Adminer is a full-featured database management tool written in PHP that supports database software such as MySQL, MariaDB, PostgreSQL and SQLite. A server-side request forgery vulnerability exists in Adminer 4.3.1 and earlier versions. An attacker can exploit this vulnerability with the help of t...

CVE-2018-7667: Server-Side Request Forgery (SSRF)

Adminer through 4.3.1 has SSRF via the server parameter...

ISPConfig <= 3.0.5.4p7 monitor/show_sys_state.php SQL注入漏洞

因为不完整地过滤导致了SQL注入, 通过HTTP GET方式传递的server参数给了 /monitor/showsysstate.php页面攻击者可以传入任意恶意SQL命令并在数据库中执行该漏洞的成功的利用可以让攻击者获得数据库的读写权限甚至危机整个web应用但是该漏洞此时仍然是一个鸡肋漏洞, 因为攻击者要进行此攻击必须是认证通过的用户而且还需要有monitor权限然而, 结合CSRF Cross-Site Request Forgery in ISPConfig:...

Electric Sheep Fencing pfsense cross-site scripting vulnerability (CNVD-2015-05674)

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in Electric Sheep Fencing pfSense versions prior to 2.2.3, which stems from the servicesntpd.php script not adequately...