1335 matches found
OpenClinic GA suffers from an unspecified vulnerability (CNVD-2021-17441)
OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. A security vulnerability exists in OpenClinic GA version 5.09.02 and 5.89.05b, which can be exploited by an attacker...
SQL Injection
Apache SkyWalking is vulnerable to SQL injection. The function getLinearIntValues in H2MetricsQueryDAO.java does not sanitize the user-provided ID parameter to the SQL query StringBuilder when H2/MySQL/TiDB is used as storage, allowing an attacker to provide arbitrary string to construct maliciou...
SQL Injection
dolibarr/dolibarr is vulnerable to SQL injection. The vulnerability exists as the id parameter type was not enforced to the int type, and could be used to inject and execute arbitrary SQL statements...
SQL Injection
@nozbe/watermelondb is vulnerable to SQL Injection. A remote attacker is able to inject and execute arbitrary SQL statements via the id parameter...
CVE-2020-13630
A use-after-free vulnerability was found in the SQLite FTS3 extension module in the way it implemented the snippet function. This flaw allows an attacker who can execute SQL statements to crash the application or potentially execute arbitrary code...
php-fusion 9.03.50 - (ctype) SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: php-fusion 9.03.50 - 'ctype' SQL Injection Exploit Author: SunCSR Sun Cyber Security Research - ThienNV Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version:...
Oracle E-Business Suite SQL Injection (CVE-2020-2586; CVE-2020-2587)
An SQL injection vulnerability exists in Oracle E-Business Suite. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL statements with the privileges of the APPS database user...
CVE-2018-16850
A SQL Injection flaw has been discovered in PostgreSQL server in the way triggers that enable transition relations are dumped. The transition relation name is not correctly quoted and it may allow an attacker with CREATE privilege on some non-temporary schema or TRIGGER privilege on some table to...
SQL Injection
phpmyadmin/phpmyadmin is vulnerable to SQL injection. A remote attacker is able to inject and execute arbitrary SQL statements to insert malicious values containing Javascript into the database. When displayed in a user's browser, the Javascript executes in the context of the user...
QIWI: Remote Code Execution on contactws.contact-sys.com via SQL injection in TCertObject operation "Delete"
Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the ID parameter to inject arbitrary SQL statements into the underlying prepared statement. This leads ...
SQL Injection
django is vulnerable to SQL injection. Lack of adequate validation and sanitization of the tolerance parameter allows an attacker to inject and execute arbitrary SQL statements in the database...
CVE-2020-9327
A NULL pointer dereference was found in SQLite in the way it executes select statements with column optimizations. An attacker who is able to execute SQL statements can use this flaw to crash the application...
Sql injection
IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, ad...
Sql injection
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 167881...
CVE-2019-4597
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 167880...
SQL Injection
@azhou/basemodel is vulnerable to SQL injection. A remote attacker is able to inject and execute arbitrary SQL statements via the orderBy variable...
SQL Injection
centreon/centreon is vulnerable to SQL Injection. The vulnerability exists as several values in multiple monitoring pages were not properly validated, allowing an attacker to inject and execute arbitrary SQL statements...
SQL Injection
geocoder is vulnerable to SQL injection. The vulnerability exists in sql.rb as the unvalidated values of swlat, swlng, nelat, nelng could be used in conjunction with withinboundingbox to inject and execute arbitrary SQL statements...
Sql injection
An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects:...
