Injection SQL

Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter. (CVSS:0.0) (Last Update:2019-01-15)

In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter. (CVSS:0.0) (Last Update:2019-01-15)

The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php. (CVSS:0.0) (Last Update:2019-01-15)

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php _data_id parameter. (CVSS:0.0) (Last Update:2019-01-14)

Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter. (CVSS:0.0) (Last Update:2019-01-15)

CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature. (CVSS:0.0) (Last Update:2019-01-15)

Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404. (CVSS:0.0) (Last Update:2019-01-15)

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table[] SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename. (CVSS:0.0) (Last Update:2019-01-11)