CWE-89

CVE-2018-14012

February 26, 2023 by

WolfSight CMS 3.2 allows SQL injection via the PATH_INFO to the default URI.

The “Firebase Cloud Messaging (FCM) + Advance Admin Panel” component supporting Firebase Push Notification on iOS (through 2017-10-26) allows SQL injection via the /advance_push/public/login username parameter.

CVE-2018-13824

February 26, 2023 by

Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks.

CVE-2018-13792

February 26, 2023 by

Multiple SQL injection vulnerabilities in the monitoring feature in the HTTP API in ABBYY FlexiCapture before 12 Release 2 allow an attacker to execute arbitrary SQL commands via the mask, sortOrder, filter, or Order parameter.

CVE-2018-13442

February 26, 2023 by

SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter.

CVE-2018-13447

February 26, 2023 by

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.