PT-2018-15439

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS versions through 2018-04-28 Description The issue allows for SQL injection, which can be used for authentication bypass. This means an attacker could potentially gain unauthorized access to th...

PT-2018-14970

Name of the Vulnerable Software and Affected Versions HuCart version 5.7.4 Description The issue concerns a SQL injection in the get ip function located in system/class/helper class.php. This occurs via the X-Forwarded-For HTTP header when accessing the "user/index.php?load=login&act=act login"...

CVE-2018-19468: Improper Neutralization of Special Elements used in an SQL Command

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...

CVE-2017-9435

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

Sql injection

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

CVE-2017-9435

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

CVE-2017-9435

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

CVE-2017-9435: Improper Neutralization of Special Elements used in an SQL Command

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

CVE-2016-2151

user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail...

CVE-2016-2151: Exposure of Sensitive Information to an Unauthorized Actor

user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail...

CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3991: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2012-6045: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2011-4802: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 sortfield, 2 sortorder, and 3 sall parameters to user/index.php and b user/group/index.php; the id parameter to 4 info.php, 5 perms.php, 6...

CVE-2008-6825: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute arbitrary files via a .. dot dot in the langChoice parameter...

TCPDB Security Bypass Vulnerability

This host is installed with TCPDB and is prone to security bypass vulnerability. OpenVAS Vulnerability Test $Id: secpodtcpdbsecbypassvuln.nasl 5122 2017-01-27 12:16:00Z teissa $ TCPDB Security Bypass Vulnerability Authors: Nikita MR Copyright: Copyright c 2009 SecPod, http://www.secpod.com This...

CVE-2009-1670

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-1670

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-1670

TCPDB 3.8 is vulnerable to a security bypass where user/index.php does not require administrative authentication, allowing remote attackers to add admin accounts via unspecified vectors. This is documented in multiple sources (NVD entry CVE-2009-1670 and OpenVAS entries) with CVSS base score 7.5 ...