CWE-89

CVE-2018-16432

February 26, 2023 by

BlueCMS 1.6 allows SQL Injection via the user_name parameter to uploads/user.php?act=index_login.

CVE-2018-16436

February 26, 2023 by

Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.

CVE-2018-16445

February 26, 2023 by

An issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an adm1n/admin_topic_vod.php request.

A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as “if”) and b is the SQL statement to be executed.

CVE-2018-16385

February 26, 2023 by

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

CVE-2018-16389

February 26, 2023 by

e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter.