CVE Vulnerability Catalog

An XML External Entity (XXE) vulnerability was found in the Conserus Image Repository solution version 2.1.1.105. An unauthenticated user can send a modified HTTP SOAP request, allowing access to the local file system and transmitting the application service's account hashed credentials to a remote attacker.

In vBulletin versions up to 5.3.x, there is an unauthenticated deserialization vulnerability that can lead to arbitrary file deletion and, under certain circumstances, code execution. This issue arises from the unsafe usage of PHP's unserialize() function in the cacheTemplates() method of the vB_Library_Template class, which is publicly exposed.

vBulletin versions up to 5.3.x on Windows allows remote PHP code execution due to the accessibility of a require_once call with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname. The blocking of ../ traversal does not apply to ..\, allowing for exploitation of this vulnerability.

Entrepreneur Dating Script version 2.0.1 has an SQL Injection vulnerability via the marital, gender, country, or profileid parameter in the search_result.php file.

Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker with the appropriate permissions can execute arbitrary code on systems running a vulnerable version of Bamboo Server.

There is a possibility of double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags. An attacker with restricted administrative rights to Bamboo can exploit this vulnerability to execute arbitrary Java code on systems running a vulnerable version of Bamboo.

Basic Job Site Script version 2.0.5 has a SQL Injection vulnerability via the keyword parameter to /job.

Resume Clone Script version 2.0.5 has a SQL Injection vulnerability via the id parameter in the preview.php file.

Advanced World Database version 2.0.5 has an SQL Injection vulnerability via the country or state parameter in city.php and the country parameter in state.php.

Muslim Matrimonial Script version 3.02 has an SQL Injection vulnerability via the succid parameter in the success-story.php file.

Groupon Clone Script version 3.01 has a SQL Injection vulnerability via the state_id parameter in the city_ajax.php file.

Car Rental Script version 2.0.4 has an SQL Injection vulnerability via the val parameter in the countrycode1.php file.

MLM Forced Matrix version 2.0.9 has a SQL Injection vulnerability via the newid parameter in the news-detail.php file.

MLM Forex Market Plan Script version 2.0.4 is vulnerable to SQL Injection via the newid parameter in news_detail.php and the eventid parameter in event_detail.php.

The Single Theater Booking Script version 3.2.1 has a SQL Injection vulnerability via the q parameter in the findcity.php file.

Multiplex Movie Theater Booking Script version 3.1.5 has an SQL Injection vulnerability via the moid parameter in trailer-detail.php, moid parameter in show-time.php, or eid parameter in event-detail.php.

The Responsive Events Movie Ticket Booking Script version 3.2.1 has an SQL Injection vulnerability via the q parameter in the findcity.php file.

Version 4.7.2 of Multireligion Responsive Matrimonial has an SQL Injection vulnerability via the succid parameter in the success-story.php file.

Yoga Class Script version 1.0 has a SQL Injection vulnerability via the /list city parameter.

Secure E-commerce Script version 2.0.1 is vulnerable to SQL Injection via the searchmain or searchcat parameters in category.php and the sid parameter in single_detail.php.