Sql injection

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sortby and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to...

CVE-2018-3884

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sortby and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to...

PT-2018-16277

Name of the Vulnerable Software and Affected Versions ERPNext version 10.1.6 Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause SQL injections, resulting in data compromise. The sort by and start parameters can...

GLPI front/devicesoundcard.php file SQL injection vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. An SQL injection vulnerability exists in the front/devicesoundcard.php...

UBUNTU-CVE-2017-11184

SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter...

Sql injection

SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter...

CVE-2017-11184

SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter...

CVE-2017-11184

SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter...

CVE-2017-11184: Improper Neutralization of Special Elements used in an SQL Command

SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter...

Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2017-04905)

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. Revive Adserver has a cross-site scripting vulnerability. A remote attacker can exploit this vulnerability to...

DWebPro 8.4.2 Local File Inclusion Vulnerability

DWebPro is a dynamic web site software package for distribution on CD/DVD or USB drives. A local file inclusion vulnerability exists in the start parameter of DWebPro, which allows an attacker to access arbitrary files and, when browsing to an executable file, execute the file with system...

CVE-2012-6519: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php...

CVE-2012-5900

Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the 1 OBID parameter in a single action to admin/action/objects.php, 2 AREAID parameter in a single action to admin/action/areas.php, or 3 start parameter in a show action...

CVE-2012-5900

Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the 1 OBID parameter in a single action to admin/action/objects.php, 2 AREAID parameter in a single action to admin/action/areas.php, or 3 start parameter in a show action...

CVE-2011-5140

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

CVE-2011-5140: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

CVE-2011-5072

Multiple SQL injection vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to portal/kb.php; 2 contractid parameter to contractaddservice.php; 3 id parameter to editescalationpath.php; 4 unlock, 5 lock...

kernel: agp: insufficient pg_start parameter checking in AGPIOC_BIND and AGPIOC_UNBIND ioctls

The agpgenericremovememory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service system crash via a crafted AGPIOCUNBIND agpioctl ioctl call, a different...

CVE-2009-5093

Directory traversal vulnerability in gastbuch.php in Gästebuch Gastebuch 1.6 allows remote attackers to read arbitrary files via a .. dot dot in the start parameter...

PT-2010-4094 · Cacti · Cacti

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 0.8.7g Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is due to an incorrect fix for a previous issue. The graph start parameter to the...