Injection SQL

SeaCMS 6.64 allows SQL Injection via the upload/admin/admin_video.php order parameter. (CVSS:0.0) (Last Update:2018-09-21)

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. (CVSS:0.0) (Last Update:2018-09-20)

IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109. (CVSS:0.0) (Last Update:2018-09-20)

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter. (CVSS:0.0) (Last Update:2018-09-20)

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. (CVSS:0.0) (Last Update:2018-09-20)

SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot (aka slack-archive-bot) before 2018-09-19 allows remote attackers to execute arbitrary SQL commands via the text parameter to cursor.execute(). (CVSS:0.0) (Last Update:2018-09-20)

The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php. (CVSS:0.0) (Last Update:2018-09-20)

zzcms 8.3 contains a SQL Injection vulnerability in /user/check.php via a Client-Ip HTTP header. (CVSS:0.0) (Last Update:2018-09-17)