CVE Vulnerability Catalog

SoftDatepro Dating Social Network version 1.3 is vulnerable to SQL Injection via the profid parameter in viewprofile.php, the sender_id parameter in viewmessage.php, and the Email field in the admin panel.

Same Sex Dating Software Pro version 1.0 is vulnerable to SQL Injection via the profid parameter in viewprofile.php, the sender_id parameter in viewmessage.php, and the Email field in the admin section.

PHP CityPortal version 2.0 is vulnerable to SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.

PG All Share Video version 1.0 allows SQL Injection via manipulation of the PATH_INFO parameter in several endpoints, such as search/tag, friends/index, users/profile, and video_catalog/category.

MyBuilder Clone version 1.0 allows SQL Injection via the subcategory parameter in the phpsqlsearch_genxml.php file.

Mailing List Manager Pro version 3.0 is vulnerable to SQL Injection via the edit parameter in the sort=login action or the edit parameter in admin/template.

The Zh YandexMap component version 6.1.1.0 for Joomla! is vulnerable to SQL Injection via the placemarklistid parameter in index.php.

The NS Download Shop component version 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create action.

Job Board Script Software is vulnerable to SQL Injection via the PATH_INFO to a /job-details URI.

iTech Gigs Script version 1.21 allows SQL Injection via the sc parameter in browse-scategory.php or the ser parameter in service-provider.php.

iStock Management System 1.0 allows Arbitrary File Upload via user/profile.

iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.

Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.

Adult Script Pro version 2.2.4 allows SQL Injection via the PATH_INFO parameter to a /download URI, which is a different vulnerability than CVE-2007-6576.

D-Park Pro Domain Parking Script version 1.0 is vulnerable to SQL Injection via the 'username' field in the admin/loginform.php login form.

In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.php. The request method to execute is GET.

The XXE vulnerability in Apache ActiveMQ 5.x before version 5.10.1 allows remote consumers to have unspecified impact via XPath based selectors when dequeuing XML messages.

The XXE vulnerability in Apache ActiveMQ Apollo 1.x before version 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

The Apache XML-RPC library version 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

An out-of-bounds read in V8 in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.