CVE Vulnerability

CWE-89

CVE-2018-11722

by

WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the ‘code’ parameter, because ‘UC_KEY’ is hard coded.

CVE-2018-11643

by

SQL injection vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to execute arbitrary SQL commands via the filterPattern parameter.

CVE-2018-11589

by

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.

CVE-2018-11511

by

The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the ‘album_id’ or ‘scope’ parameter via a photo-gallery/api/album/tree_lists/ URI.

CVE-2018-11515

by

The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.

CVE-2018-11528

by

WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.