CVE-2018-8097

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

CVE-2018-8097

CVE-2018-8097 affects Eve (aka pyeve) prior to 0.7.5. The vulnerability resides in io/mongo/parser.py where the where parameter enables Code Injection, allowing remote execution of arbitrary code. Multiple sources corroborate remote-code-execution via this parameter. A PoC/notice exists showing f...

CVE-2018-8097: Improper Control of Generation of Code

io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...

PT-2018-18428

Name of the Vulnerable Software and Affected Versions: Eve aka pyeve versions prior to 0.7.5 Description: The issue allows remote attackers to execute arbitrary code via Code Injection in the where parameter. This is related to the io/mongo/parser.py file in Eve. Recommendations: For versions pri...

PT-2015-3616

Name of the Vulnerable Software and Affected Versions ClanSphere version 2011.4 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the where parameter in a list action to "index.php". Recommendations For ClanSphere version 2011.4, consider...

CVE-2014-100010: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ClanSphere 2011.4 allows remote attackers to inject arbitrary web script or HTML via the where parameter in a list action to index.php...

CVE-2012-4949: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...

CVE-2011-4833: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the 1 where and 2 order parameters in a getfulllist action to index.php...

CVE-2008-6242: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in SearchResults.php in Scripts For Sites SFS EZ e-store allows remote attackers to execute arbitrary SQL commands via the where parameter...

CVE-2004-2737: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter...

Sql injection

Multiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via 1 the searchword parameter in certain files; the where parameter in 2 plugins/search/content.php or 3 plugins/search/weblinks.php; the text parameter in 4...

CVE-2006-3394: Undefined Security Weakness

SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary SQL commands via the where parameter in a view action...