rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-9175 
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9176 
Cross-site scripting (XSS) vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to lp/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9177 
The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9178 
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9179 
Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL (optional)" field in a new ticket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9180 
Open redirect vulnerability in go.php in Eleanor CMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the QUERY_STRING.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9181 
Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resources/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9182 
models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T18:00:00.000Z
CVE-2014-9183 
ZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote attackers to gain administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T18:00:00.000Z
CVE-2014-9184 
ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3) userpasswd.cgi, (4) upload.cgi, (5) conprocess.cgi, or (6) connect.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T18:00:00.000Z
CVE-2014-9185 
Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into config.php via the site_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2014-9186 
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Problem types: cwe_id: CWE-98
description: File inclusion CWE-98
Affected products: vendor: Honeywell
product: Experion PKS
Published: 2019-04-08T15:09:55.000Z
CVE-2014-9187 
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Problem types: cwe_id: CWE-122
description: Heap-based buffer overflow CWE-122
Affected products: vendor: Honeywell
product: Experion PKS
Published: 2019-03-25T19:19:10.000Z
CVE-2014-9188 Schneider Electric ProClima Command Injection
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-8514.  NOTE: this may be clarified later based on details provided by researchers.
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: Schneider Electric
product: ProClima
default_status: unaffected
Credits: lang: en
value: This vulnerability was reported to ZDI by security researchers Ariele Caltabiano, Andrea Micalizzi, and Brian Gorenc.
Published: 2014-12-27T15:00:00.000Z
CVE-2014-9189 
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Problem types: cwe_id: CWE-121
description: Stack-based buffer overflow CWE-121
Affected products: vendor: Honeywell
product: Experion PKS
Published: 2019-03-25T19:10:47.000Z
CVE-2014-9190 Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow
Stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Schneider Electric
product: InTouch Access Anywhere Server
default_status: unaffected
Published: 2015-01-10T02:00:00.000Z
CVE-2014-9191 
The CodeWrights HART Device Type Manager (DTM) library in Emerson HART DTM before 1.4.181 allows physically proximate attackers to cause a denial of service (DTM outage and FDT Frame application hang) by transmitting crafted response packets on the 4-20 mA current loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-10T02:00:00.000Z
CVE-2014-9192 Trihedral Engineering Limited VTScada Integer Overflow
Integer overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: Trihedral Engineering
product: VTS
default_status: unaffected
Credits: lang: en
value: An anonymous researcher working with HP’s Zero Day Initiative has identified an integer overflow vulnerability in Trihedral Engineering Ltd’s VTScada application.
Published: 2014-12-11T15:00:00.000Z
CVE-2014-9193 Innominate mGuard Improper Privilege Management
Innominate mGuard with firmware before 7.6.6 and 8.x before 8.1.4 allows remote authenticated admins to obtain root privileges by changing a PPP configuration setting.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: Innominate
product: mGuard
default_status: unaffected
Credits: lang: en
value: Innominate Security Technologies has identified a privilege escalation vulnerability affecting all mGuard devices.
Published: 2014-12-20T00:00:00.000Z
CVE-2014-9194 Arbiter Systems 1094B GPS Clock Insufficient Verification of Data Authenticity
Arbiter 1094B GPS Substation Clock allows remote attackers to cause a denial of service (disruption) via crafted radio transmissions that spoof GPS satellite broadcasts.
Problem types: cwe_id: CWE-345
description: CWE-345
Affected products: vendor: Arbiter Systems
product: Model 1094B GPS Substation Clock
default_status: unaffected
Published: 2015-01-17T02:00:00.000Z
CVE-2014-9195 Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function
Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Phoenix Contact
product: ProConOs
default_status: unaffected
vendor: Phoenix Contact
product: MultiProg
default_status: unaffected
Credits: lang: en
value: Reid Wightman of Digital Bond
Published: 2015-01-17T02:00:00.000Z
CVE-2014-9196 Eaton’s Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet
Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
Problem types: cwe_id: CWE-342
description: CWE-342
Affected products: vendor: Eaton’s Cooper Power Systems
product: Series Form 6
default_status: unaffected
vendor: Eaton’s Cooper Power Systems
product: Idea/IdeaPLUS relays
default_status: unaffected
Credits: lang: en
value: Dr. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a research project partially sponsored by the Georgia Tech National Electric Energy Testing Research and Applications Center (NEETRAC)
Published: 2015-07-20T01:00:00.000Z
CVE-2014-9197 Schneider Electric ETG3000 FactoryCast HMI Gateway Missing Authentication for Critical Function
The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Schneider Electric
product: ETG3000 FactoryCast HMI Gateway
default_status: unaffected
Credits: lang: en
value: Narendra Shinde of Qualys Security
Published: 2015-01-27T11:00:00.000Z
CVE-2014-9198 Schneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded Credentials
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Schneider Electric
product: ETG3000 FactoryCast HMI Gateway
default_status: unaffected
Credits: lang: en
value: Narendra Shinde of Qualys Security
Published: 2015-01-27T11:00:00.000Z
CVE-2014-9199 Clorius Controls A/S ISC SCADA Insecure Java Client Inadequate Encryption Strength
The Clorius Controls Java web client before 01.00.0009g allows remote attackers to discover credentials by sniffing the network for cleartext-equivalent traffic.
Problem types: cwe_id: CWE-326
description: CWE-326
Affected products: vendor: Clorius Controls
product: A/S Java web client
default_status: unaffected
Credits: lang: en
value: Aditya Sood
Published: 2015-01-17T02:00:00.000Z
CVE-2014-9200 Schneider Electric Device Type Managers (DTMs) Stack-based Buffer Overflow
Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier, CANopen Communication Library 1.0.2 and earlier, EtherNet/IP Communication Library 1.0.0 and earlier, EM X80 Gateway DTM (MB TCP/SL), Advantys DTM for OTB, Advantys DTM for STB, KINOS DTM, SOLO DTM, and Xantrex DTMs allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Schneider Electric
product: Unity Pro
default_status: unaffected
vendor: Schneider Electric
product: SoMachine
default_status: unaffected
vendor: Schneider Electric
product: SoMove
default_status: unaffected
vendor: Schneider Electric
product: SoMove Lite
default_status: unaffected
vendor: Schneider Electric
product: Modbus Communication Library
default_status: unaffected
vendor: Schneider Electric
product: CANopen Communication Library
default_status: unaffected
vendor: Schneider Electric
product: EtherNet/IP Communication Library
default_status: unaffected
vendor: Schneider Electric
product: EM X80 Gateway DTM (MB TCP/SL)
default_status: unaffected
vendor: Schneider Electric
product: Advantys DTMs (OTB, STB)
default_status: unaffected
vendor: Schneider Electric
product: KINOS DTM
default_status: unaffected
vendor: Schneider Electric
product: SOLO DTM
default_status: unaffected
vendor: Schneider Electric
product: Xantrex DTM
default_status: unaffected
Credits: lang: en
value: Ariele Caltabiano (kimiya) with HP’s Zero Day Initiative (ZDI)
Published: 2015-02-01T15:00:00.000Z
CVE-2014-9201 
Beckwith Electric M-6200 Digital Voltage Regulator Control with firmware before D-0198V04.07.00, M-6200A Digital Voltage Regulator Control with firmware before D-0228V02.01.07, M-2001D Digital Tapchanger Control with firmware before D-0214V01.10.04, M-6283A Three Phase Digital Capacitor Bank Control with firmware before D-0346V03.00.02, M-6280A Digital Capacitor Bank Control with firmware before D-0254V03.05.05, and M-6280 Digital Capacitor Bank Control do not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-05T10:00:00.000Z
CVE-2014-9202 
Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0_20150816 allow remote attackers to execute arbitrary code via a crafted file that triggers long string arguments to functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-28T01:00:00.000Z
CVE-2014-9203 
Buffer overflow in the Field Device Tool (FDT) Frame application in the HART Device Type Manager (DTM) library, as used in MACTek Bullet DTM 1.00.0, GE Vector DTM 1.00.0, GE SVi1000 Positioner DTM 1.00.0, GE SVI II AP Positioner DTM 2.00.1, and GE 12400 Level Transmitter DTM 1.00.0, allows remote attackers to cause a denial of service (DTM outage) via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-07T15:00:00.000Z
CVE-2014-9204 
Stack-based buffer overflow in OPCTest.exe in Rockwell Automation RSLinx Classic before 3.73.00 allows remote attackers to execute arbitrary code via a crafted CSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-17T01:00:00.000Z
CVE-2014-9205 
Stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC stable before 8.2.19 and PROMOTIC development before 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-29T10:00:00.000Z
CVE-2014-9206 
Stack-based buffer overflow in Device Type Manager (DTM) 3.1.6 and earlier for Schneider Electric Invensys SRD Control Valve Positioner devices 960 and 991 allows local users to gain privileges via a malformed DLL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-14T01:00:00.000Z
CVE-2014-9207 
Untrusted search path vulnerability in CmnView.exe in CIMON CmnView 2.14.0.1 and 3.x before UltimateAccess 3.02 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-14T01:00:00.000Z
CVE-2014-9208 
Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-11T16:00:00.000Z
CVE-2014-9209 
Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-31T01:00:00.000Z
CVE-2014-9211 
ClickDesk version 4.3 and below has persistent cross site scripting
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-14T13:54:47.000Z
CVE-2014-9212 
Multiple cross-site scripting (XSS) vulnerabilities in Altitude uAgent in Altitude uCI (Unified Customer Interaction) 7.5 allow remote attackers to inject arbitrary web script or HTML via (1) an email hyperlink or the (2) style parameter in the image attribute section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-9215 
SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 allows remote attackers to execute arbitrary SQL commands via the email parameter in the register page to index.php.  NOTE: the email parameter in the forget page vector is already covered by CVE-2012-4034.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-9217 
Graylog2 before 0.92 allows remote attackers to bypass LDAP authentication via crafted wildcards.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T11:00:00.000Z
CVE-2014-9218 
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T11:00:00.000Z
CVE-2014-9219 
Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T11:00:00.000Z
CVE-2014-9220 
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T01:00:00.000Z
CVE-2014-9221 
strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-07T19:00:00.000Z
CVE-2014-9222 
AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption, aka the "Misfortune Cookie" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-24T18:00:00.000Z
CVE-2014-9223 
Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors related to authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-24T18:00:00.000Z
CVE-2014-9224 
Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T11:00:00.000Z
CVE-2014-9225 
The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T11:00:00.000Z
CVE-2014-9226 
The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows local users to bypass intended Protection Policies via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T11:00:00.000Z
CVE-2014-9227 
Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-20T20:00:00.000Z
CVE-2014-9228 
sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (blocked system shutdown) by triggering an unspecified deadlock condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-20T20:00:00.000Z
CVE-2014-9229 
Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-20T20:00:00.000Z
CVE-2014-9230 
Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-28T19:00:00.000Z
CVE-2014-9234 
Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T21:00:00.000Z
CVE-2014-9235 
Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) _action parameter to group.php or (2) user.php or the (3) location_id parameter to photos.php in php/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T21:00:00.000Z