CVE Vulnerability Catalog

FS Shutterstock Clone version 1.0 has a SQL Injection vulnerability via the keywords parameter in the /Category path.

FS Grubhub Clone version 1.0 has a SQL Injection vulnerability via the /food keywords parameter.

FS Quibids Clone version 1.0 has a SQL Injection vulnerability via the productid parameter in the itechd.php file.

FS Linkedin Clone version 1.0 has a SQL Injection vulnerability via the grid parameter in group.php, fid parameter in profile.php, or id parameter in company_details.php.

FS Freelancer Clone version 1.0 has a SQL Injection vulnerability via the u parameter in the profile.php file.

FS Crowdfunding Script version 1.0 has a SQL Injection vulnerability via the id parameter in the latest_news_details.php file.

FS Trademe Clone version 1.0 has a SQL Injection vulnerability via the search parameter in search_item.php or the id parameter in general_item_details.php.

FS Gigs Script version 1.0 has a SQL Injection vulnerability via the cat parameter in browse-category.php, sc parameter in browse-scategory.php, or ser parameter in service-provider.php.

FS Groupon Clone version 1.0 has a SQL Injection vulnerability via the id parameter in item_details.php and vendor_details.php files.

FS Care Clone version 1.0 has a SQL Injection vulnerability via the jobType or jobFrequency parameter in the searchJob.php file.

FS Ebay Clone version 1.0 has an SQL Injection vulnerability via the id parameter in product.php or the category_id or sub_category_id parameters in search.php.

FS Amazon Clone version 1.0 has a SQL Injection vulnerability via the PATH_INFO parameter in the /VerAyari path.

FS Foodpanda Clone version 1.0 has a SQL Injection vulnerability via the keywords parameter in the /food path.

FS Expedia Clone version 1.0 has a SQL Injection vulnerability via the id parameter in pages.php or content.php, or the fl_orig or fl_dest parameter in show-flight-result.php.

A vulnerability in Device Guard in Windows 10 and Windows Server allows a security feature bypass due to improper handling of untrusted files.

An issue was discovered on Western Digital MyCloud PR4100 devices running version 2.30.172. The web administration component allows multipart uploads without authentication, enabling an attacker to upload a PHP shell to the device's file system.

The SAP Business Intelligence Promotion Management Application in versions 4.10, 4.20, and 4.30 does not perform authentication checks for functionalities that require user identity.

Node.js was affected by an OpenSSL vulnerability (CVE-2017-3737) related to the use of SSL_read() due to TLS handshake failure. An active network attacker could send application data to Node.js, bypassing TLS authentication and encryption.

Posty Readymade Classifieds Script version 1.0 allows an attacker to inject SQL commands via requests to listings.php?catid= or ads-details.php?ID=.

Techno Portfolio Management Panel version 1.0 allows an attacker to inject SQL commands via a single.php?id= request.