Archive
October 2017
Vulnerabilities first published in this month (UTC), newest first.
172 results · Clear filters · Feed
-
Unscored —CVE-2017-15884 Public exploit
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently s…
-
Unscored —CVE-2017-15950 Public exploit
Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary c…
-
Unscored —CVE-2017-15991 Public exploit
Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_typ…
-
Unscored —CVE-2017-15985 Public exploit
Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
-
Unscored —CVE-2017-15983 Public exploit
MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editin…
-
Unscored —CVE-2017-15992 Public exploit
Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
-
Unscored —CVE-2017-15993 Public exploit
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
-
Unscored —CVE-2017-15986 Public exploit
CPA Lead Reward Script allows SQL Injection via the username parameter.
-
Unscored —CVE-2017-15990 Public exploit
Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
-
Unscored —CVE-2017-15977 Public exploit
Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
-
Unscored —CVE-2017-15989 Public exploit
Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
-
Unscored —CVE-2017-15984 Public exploit
Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.
-
Unscored —CVE-2017-15978 Public exploit
AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
-
Unscored —CVE-2017-15979 Public exploit
Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.
-
Unscored —CVE-2017-15987 Public exploit
Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
-
Unscored —CVE-2017-15980 Public exploit
US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
-
Unscored —CVE-2017-15982 Public exploit
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form edit…
-
Unscored —CVE-2017-15988 Public exploit
Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-200…
-
Unscored —CVE-2017-15981 Public exploit
Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for f…
-
Unscored —CVE-2017-15920 Public exploit
In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointe…
-
Unscored —CVE-2017-15921 Public exploit
In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointe…
-
Unscored —
Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to tru…
-
Unscored —
An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentE…
-
Unscored —CVE-2017-15968 Public exploit
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
-
Unscored —CVE-2017-15974 Public exploit
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
-
Unscored —CVE-2017-15975 Public exploit
Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability…
-
Unscored —CVE-2017-15970 Public exploit
PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
-
Unscored —CVE-2017-15976 Public exploit
ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-20…
-
Unscored —CVE-2017-15956 Public exploit
ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.
-
Unscored —CVE-2017-15969 Public exploit
PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_cat…
-
Unscored —CVE-2017-15958 Public exploit
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
-
Unscored —CVE-2017-15961 Public exploit
iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.
-
Unscored —CVE-2017-15957 Public exploit
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
-
Unscored —CVE-2017-15965 Public exploit
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in…
-
Unscored —CVE-2017-15972 Public exploit
SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.ph…
-
Unscored —CVE-2017-15973 Public exploit
Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
-
Unscored —CVE-2017-15960 Public exploit
Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.
-
Unscored —CVE-2017-15959 Public exploit
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-20…
-
Unscored —CVE-2017-15967 Public exploit
Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the …
-
Unscored —CVE-2017-15966 Public exploit
The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid param…