52 matches found
CVE-2018-16432
BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...
Sql injection
BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...
CVE-2018-16432
BlueCMS 1.6 is affected by CVE-2018-16432 via SQL injection in the user_name parameter to uploads/user.php?act=index_login. The underlying issue is improper input handling that enables an attacker to inject SQL through that parameter. The CVSS metrics indicate a high to critical impact (CVSSv2: 7...
CVE-2018-16432
BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...
QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the USERNAME parameter provided to the changepassword.cgi endpoint. The issue...
Sql injection
The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT UPDATE" section...
CVE-2017-14402
The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...
Sql injection
The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...
CVE-2017-14402
The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...
CVE-2017-14401
The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT UPDATE" section...
CVE-2017-14401
The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT UPDATE" section...
CVE-2017-14401
The EyesOfNetwork web interface (eonweb) 5.1-0 contains a SQL injection vulnerability in the USERNAME column, exploitable via the user_name parameter to module/admin_user/add_modify_user.php within the ACCOUNT UPDATE section. This allows an attacker to construct arbitrary SQL commands, enabling d...
CVE-2017-14402
The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...
CVE-2013-3933
Cross-site scripting XSS vulnerability in the JoomShopping comjoomshopping component before 4.3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the username parameter to index.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the JoomShopping comjoomshopping component before 4.3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the username parameter to index.php...
CVE-2013-3933
Cross-site scripting XSS vulnerability in the JoomShopping comjoomshopping component before 4.3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the username parameter to index.php...
CVE-2008-6608
Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary SQL commands via 1 the username parameter aka user field to admin/index.php, 2 the userpass parameter aka pass field to admin/index.php, or 3 the id parameter to...
Cross site scripting
Cross-site scripting XSS vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject arbitrary web script or HTML via the username field username parameter...
CVE-2008-6348
Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the 1 catid parameter to gallerycategory.php, 2 photoid parameter to galleryphoto.php, and the 3 username and 4 userpass parameters to admin/index.php. NOTE: some...