eddietcc/CVEnotes

Releases0

Stars24

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2019-7747 ↗	Feb 11, 2019Monday, 11 February 2019, 21:29	—	6.8 MEDIUM
DbNinja 3.2.7 allows session fixation via the data.php sessid parameter.
CVE-2019-7748 ↗	Feb 11, 2019Monday, 11 February 2019, 21:29	—	4.3 MEDIUM
_includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.
CVE-2019-7730 ↗	Feb 11, 2019Monday, 11 February 2019, 17:29	—	4.9 MEDIUM
MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnerability for deleting a database via the /?q=wrkfrm&type=databases URI.
CVE-2019-7731 ↗	Feb 11, 2019Monday, 11 February 2019, 17:29	—	7.5 HIGH
MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function with a .php filename for the backup's archive file.
CVE-2019-7316 ↗	Feb 4, 2019Monday, 4 February 2019, 08:29	—	7.5 HIGH
An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability.
CVE-2018-20420 ↗	Dec 24, 2018Monday, 24 December 2018, 03:29	—	5.5 MEDIUM
In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.
CVE-2018-19785 ↗	Dec 1, 2018Saturday, 1 December 2018, 00:29	—	4.3 MEDIUM
PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.
CVE-2018-19434 ↗	Nov 22, 2018Thursday, 22 November 2018, 05:29	—	6.5 MEDIUM
An issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind SQL injection via the AmtClear_ parameter.