CVE-2026-48240

Open ISES Tickets ≤ 3.44.2 contains a SQL injection in ajax/statistics.php where POST tick_id and f_tick_id are concatenated into WHERE clauses of statistics rollup queries without sanitization. This allows authenticated users to alter query semantics and read/modify/destroy database contents. A ...

CVE-2026-48240: Improper Neutralization of Special Elements used in an SQL Command

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tickid and ftickid POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authenticated attackers can craft requests tha...

CVE-2023-36306: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components...

Cross-site Scripting (XSS)

forkcms is vulnerable to cross-site scripting XSS attacks. The library does not properly escape special characters in the src/Backend/Modules/Search/Actions/Statistics.php file, allowing a malicious user to inject and execute arbitrary web script...

dogshow.sk XSS vulnerability

Vulnerable URL: http://dogshow.sk/statistics.php Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 11:14 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1840924 VIP website status:| No Check dogshow.sk SSL...

PHPKick 0.8 - statistics.php SQL Injection Exploit

No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class TestPOCPOCBase: vulID = '69551' version = '1' author = 'RickGray' vulDate = '2010-08-08' createDate = '2015-10-15'...

CVE-2011-3752

LimeSurvey 1.90+ build9642-20101214 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/statistics.php and certain other files...

CVE-2011-3715: Exposure of Sensitive Information to an Unauthorized Actor

ClanTiger 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/statistics/statistics.php and certain other files...

CVE-2010-3029

SQL injection vulnerability in statistics.php in PHPKick 0.8 allows remote attackers to execute arbitrary SQL commands via the gameday parameter in an overview action...

Sql injection

SQL injection vulnerability in statistics.php in PHPKick 0.8 allows remote attackers to execute arbitrary SQL commands via the gameday parameter in an overview action...

CVE-2010-3029

CVE-2010-3029 : PHPKick 0.8 has an SQL injection in the statistics.php file, exploitable via the gameday parameter in an overview action, allowing remote attackers to execute arbitrary SQL. The affected component is statistics.php within PHPKick 0.8; root cause is a vulnerability in input handlin...

CVE-2010-3029

SQL injection vulnerability in statistics.php in PHPKick 0.8 allows remote attackers to execute arbitrary SQL commands via the gameday parameter in an overview action...

CVE-2010-3029: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in statistics.php in PHPKick 0.8 allows remote attackers to execute arbitrary SQL commands via the gameday parameter in an overview action...

PHPKick v0.8 statistics.php SQL Injection Exploit

Exploit for php platform in category web applications ================================================= PHPKick v0.8 statistics.php SQL Injection Exploit ================================================= Date: August 8th, 2010 Time: 03:45am ; Author: garwga Version: 0.8 Google dork : "© 2004...

PHPKick 0.8 - 'Statistics.php' SQL Injection

Exploit Title: PHPKick v0.8 statistics.php SQL Injection Date: August 8th, 2010 Time: 03:45am ; Author: garwga Version: 0.8 Google dork : "© 2004 PHPKick.de Version 0.8" Category: webapps/0day Code: see below ?php echo"\n\n"; echo"|=================PHPKick v0.8 statistics.php SQL...

CVE-2008-3923

CVE-2008-3923 affects Content Management Made Easy (CMME) 1.12. The vulnerability is a set of cross-site scripting (XSS) flaws in statistics.php, exploitable via the hstat_year action through the page and year parameters. The underlying cause is improper input handling/sanitization of these param...

CVE-2008-3923

Multiple cross-site scripting XSS vulnerabilities in statistics.php in Content Management Made Easy CMME 1.12 allow remote attackers to inject arbitrary web script or HTML via the 1 page and 2 year parameters in an hstatyear action...

CVE-2008-3923: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in statistics.php in Content Management Made Easy CMME 1.12 allow remote attackers to inject arbitrary web script or HTML via the 1 page and 2 year parameters in an hstatyear action...

CVE-2007-6554: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter to 1 index.php, 2 register.php, 3 login.php, or 4 statistics.php...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFLFILEROOT parameter to 1 admin.php, 2 custompages.php, 3 draft.php, 4 faq.php, 5 leagues.php, 6 livedraft.php, 7 login.php, 8 myteam.php, 9 profile.php, 10...