CVE Vulnerability Catalog

PHP Scripts Mall PHP Multivendor Ecommerce has an SQL Injection vulnerability via the fid parameter in my_wishlist.php.

PHP Scripts Mall PHP Multivendor Ecommerce is vulnerable to SQL Injection via the cusid parameter in shopping-cart.php.

Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. The deserialization process can execute code that has undesired side effects for several known types.

A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine.

The AirLive BU-2015, BU-3026, MD-3025, WL-2000CAM, and POE-200CAM v2 devices have a vulnerability related to the use of hard-coded credentials in the embedded Boa web server. Attackers can gain access to user data through specially crafted HTTP requests.

The Easy2Map plugin before version 1.3.0 for WordPress contains multiple directory traversal vulnerabilities in the includes/MapImportCSV2.php and includes/MapImportCSV.php files, allowing remote attackers to include and execute arbitrary files via the csvfile parameter related to upload file functionality.

The RPC service in Tripwire IP360 VnE Manager versions 7.2.2 and earlier allows remote attackers to bypass authentication and enumerate users, reset passwords, or manipulate IP filter restrictions via crafted 'privileged commands'.

A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03. The integrated web server (port 80/tcp) of the affected devices could allow an unauthenticated remote attacker to perform administrative operations over the network.

PHP Scripts Mall Resume Clone Script is vulnerable to SQL Injection via the 'username' parameter in forget.php.

PHP Scripts Mall Professional Service Script is vulnerable to SQL injection via the id parameter in admin/review.php.

PHP Scripts Mall Car Rental Script is vulnerable to SQL Injection via the carid parameter in admin/carlistedit.php.

Version 6.0.4 of Dolibarr ERP/CRM contains an SQL injection vulnerability in fourn/index.php that allows remote attackers to execute arbitrary SQL commands via the socid parameter.

An SQL injection vulnerability in Dolibarr ERP/CRM version 6.0.4 in adherents/subscription/info.php allows remote attackers to execute arbitrary SQL commands via the rowid parameter.

SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Readymade Job Site Script is vulnerable to SQL Injection via the location_name array parameter in the /job URI.

Readymade Video Sharing Script is vulnerable to SQL Injection via the chnlid parameter in viewsubs.php or the search parameter in search_video.php.

An issue was discovered in Valve Steam Link build 643 where root passwords longer than 8 characters are truncated due to the default use of the DES algorithm.

An issue was discovered in Valve Steam Link build 643 related to the availability of the SSH daemon. When the SSH daemon is enabled for local development, the device is publicly accessible via IPv6 TCP port 22 by default, making it easier for remote attackers to gain access by guessing 24 bits of the MAC address and attempting a root login.

The JEXTN FAQ Pro extension version 4.0.0 for Joomla! has a SQL Injection vulnerability via the id parameter in a view=category action.

Vanguard Marketplace Digital Products PHP version 1.4 is vulnerable to SQL Injection via the PATH_INFO parameter in the /p URI.