Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 28

Export CSV
CVE-2018-25189

Data Center Audit 2.6.2 SQL Injection via username Parameter

Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive database information including usernames, database names, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sourceforge
Products
Data Center Audit
CVE-2018-25177

Data Center Audit 2.6.2 Cross-Site Request Forgery via dca_resetpw.php

Data Center Audit 2.6.2 contains a cross-site request forgery vulnerability that allows attackers to reset administrator passwords without authentication by submitting crafted POST requests. Attackers can send requests to dca_resetpw.php with parameters updateuser, pass, pass2, and submit_reset to change the admin account password and gain administrative access.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sourceforge
Products
Data Center Audit
CVE-2018-25209

OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter

OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sourceforge
Products
Openbiz Cubi Lite
CVE-2019-25632

phpFileManager 1.7.8 Local File Inclusion via index.php

phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dulldusk Sourceforge
Products
Phpfilemanager Phpfilemanager
CVE-2019-25538

202CMS v10 beta SQL Injection via log_user Parameter

202CMS v10 beta contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send crafted requests with malicious SQL statements in the log_user field to extract sensitive database information or modify database contents.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Konradpl99 Sourceforge
Products
202cms 202cms
CVE-2019-25539

202CMS v10 beta SQL Injection via register.php

202CMS v10 beta contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send POST requests to index.php with crafted SQL payloads using time-based blind injection techniques to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Konradpl99 Sourceforge
Products
202cms 202cms
CVE-2018-25178

Easyndexer 1.0 Arbitrary File Download via showtif.php

Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rul10 Sourceforge
Products
Easyndexer Easyndexer
CVE-2018-25190

Easyndexer 1.0 Cross-Site Request Forgery via createuser.php

Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username, password, name, surname, and privileges set to 1 for administrator access.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rul10 Sourceforge
Products
Easyndexer Easyndexer