Web servers PHPMyAdmin Suspicious Table Hyperlink (CVE-2017-1000499)

A PhpMyAdmin user could be subject to a phishing attack. This is due to the way PhpMyAdmin handles modify requests. A successful attack could lead to malicious SQL command execution...

CVE-2017-14723: Improper Neutralization of Special Elements used in an SQL Command

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

How to delete the Device Entry for a User directly from the SQL Database

For some reason like datacorruption or some null pointers, device information is not getting removed fromthe XenMobile Console. This can be deleted directly from the Database by running the below SQL command. Please take the DB back up before we run the below SQL query First obtain the Device ID...

CVE-2017-1002023: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easyteammanagerdescedit.php...

DeWorkshop 1.0 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: DeWorkshop 1.0 - Arbitrary File Upload Dork: N/A Date: 18.08.2017 Vendor Homepage : https://sarutech.com/ Software Link: https://codecanyon.net/item/deworkshop-auto-workshop-portal/20336737 Demo:...

LiveInvoices 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: LiveInvoices 1.0 - SQL Injection Dork: N/A Date: 18.08.2017 Vendor Homepage : http://livecrm.co/ Software Link: https://codecanyon.net/item/liveinvoices-complete-invoicing-system-crm/20243375 Demo:...

CVE-2017-1183: Improper Neutralization of Special Elements used in an SQL Command

IBM Tivoli Monitoring Portal v6 could allow a local network adjacent attacker to modify SQL commands to the Portal Server, when default client-server communications, HTTP, are being used. IBM X-Force ID: 123494...

CVE-2017-7681: Improper Neutralization of Special Elements used in an SQL Command

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end...

(0Day) Schneider Electric U.motion Builder SOAP Request Remote SQL Command Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL commands on vulnerable installations of Schneider Electric U.Motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of SOAP requests by the web service. The system...

CVE-2016-1218: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Cybozu Garoon before 4.2.2...

JVN#73083905: Multiple vulnerabilities in WBCE CMS

WBCE CMS provided by WBCE Team is an open-source Contents Management System CMS. WBCE CMS contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2017-2118 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2|...

CVE-2016-9287: Improper Neutralization of Special Elements used in an SQL Command

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

weaver 0A系统在com.eweaver.base.DataAction处存在任意SQL命令执行漏洞

No description provided by source...

HumHub 0.11.20.20.0-beta.2 - SQL Injection

HumHub 0.11.20.20.0-beta.2 - SQL Injection === LSE Leading Security Experts GmbH - Security Advisory 2015-10-14 === HumHub - SQL-Injection ------------------------------------------------------------------------ Tested Versions =============== HumHub 0.11.2 and 0.20.0-beta.2 Issue Overview...

CVE-2015-7036

The fts3tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via a SQL command that triggers an API call with a crafted pointer value in the second argument...

CVE-2015-7036

The fts3tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via a SQL command that triggers an API call with a crafted pointer value in the second argument...

SUSE-OU-2015:1847-1 Optional update for postgresql94

This update delivers PostgreSQL 9.4.5 to the SUSE Linux Enterprise 12 codebase. Major enhancements: Security and bugfix release 9.4.5: CVE-2015-5289, bsc949670: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service...

Mango Automation Multiple Vulnerabilities

Mango Automation is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2015-7418

Name of the Vulnerable Software and Affected Versions JSP/MySQL Administrador Web version 1 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that execute arbitrary SQL commands. This is achieved via the cmd parameter to the...

JSPMySQL Administrador CSRF & XSS Vulnerabilities

JSPMySQL Administrador，通过基于jsp技术的B/S模式来远程管理MySQL数据库。下载链接：https://sites.google.com/site/mfpledon/producao-de-software影响版本：JSPMySQL Administrador V.1漏洞类型：CSRF、XSS漏洞等级: 高危CVE-ID：N/A披露时间：供应商通知：2015年8月31日公开披露：2015年9月4日漏洞详情：1）允许远程攻击者在没有CSRF令牌的情况下，在MySQL数据库中执行任意的SQL命令。2）listabd2.jsp中存在XSS的切入点。请求方法：POST ...