rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-25406 eNdonesia Portal 8.7 SQL Injection via mod.php
eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across publisher, diskusi, galeri, content, and about modules to extract database credentials, usernames, and version information.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Endonesia
product: eNdonesia Portal
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:14.125Z
CVE-2018-25407 eNdonesia Portal 8.7 SQL Injection via mod.php
eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across publisher, diskusi, galeri, content, and about modules to extract database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Endonesia
product: eNdonesia Portal
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:14.886Z
CVE-2018-25408 The Open ISES Project 3.30A Path Traversal Arbitrary File Download
The Open ISES Project 3.30A contains a path traversal vulnerability in the ajax/download.php endpoint that allows unauthenticated attackers to download arbitrary files by manipulating the filename parameter. Attackers can supply directory traversal sequences ../ in the filename parameter to access files outside the intended directory, including configuration files and system files.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Openises
product: Open ISES Project
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:15.687Z
CVE-2018-25409 SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php
SIM-PKH 2.4.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by submitting PHP code through the fupload parameter. Attackers can upload PHP files via the aksi_pengurus.php endpoint with module=pengurus and act=update parameters, which are stored in the foto directory and executed as web scripts.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Simpkh
product: SIM-PKH
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:16.382Z
CVE-2018-25410 SIM-PKH 2.4.1 SQL Injection via media.php id Parameter
SIM-PKH 2.4.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to /admin/media.php with module=pengurus and act=editpengurus parameters containing SQL UNION statements to extract database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Simpkh
product: SIM-PKH
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:17.141Z
CVE-2018-25411 MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php
MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to email.php with crafted SQL payloads in the 'id' parameter to extract sensitive database information including table and column names.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: M-Gb
product: MGB OpenSource Guestbook
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:17.817Z
CVE-2018-25412 Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php
Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files with arbitrary content to the upload directory and execute them on the server for remote code execution.
Problem types: cwe_id: CWE-306
description: Missing Authentication for Critical Function
Affected products: vendor: Deltasql
product: Delta Sql
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:18.571Z
CVE-2018-25413 AiOPMSD Final 1.0.0 SQL Injection via search.php
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiopmsd
product: AiOPMSD Final
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:19.369Z
CVE-2018-25414 AiOPMSD Final 1.0.0 SQL Injection via actor.php
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the actor parameter. Attackers can send GET requests to actor.php with crafted SQL payloads in the actor parameter to extract sensitive database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiopmsd
product: AiOPMSD Final
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:20.138Z
CVE-2018-25415 AiOPMSD Final 1.0.0 SQL Injection via director Parameter
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the director parameter. Attackers can send GET requests to director.php with crafted SQL payloads in the director parameter to extract sensitive database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiopmsd
product: AiOPMSD Final
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:20.917Z
CVE-2018-25416 AiOPMSD Final 1.0.0 SQL Injection via country.php
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the country parameter. Attackers can send GET requests to country.php with crafted SQL payloads in the country parameter to extract sensitive database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiopmsd
product: AiOPMSD Final
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:21.616Z
CVE-2018-25417 AiOPMSD Final 1.0.0 SQL Injection via quality.php
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the quality parameter. Attackers can send GET requests to quality.php with crafted SQL payloads in the quality parameter to extract sensitive database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiopmsd
product: AiOPMSD Final
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:22.355Z
CVE-2018-25418 AiOPMSD Final 1.0.0 SQL Injection via year.php
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the year parameter. Attackers can send GET requests to year.php with crafted SQL payloads in the year parameter to extract sensitive database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiopmsd
product: AiOPMSD Final
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:23.060Z
CVE-2018-25419 AiOPMSD Final 1.0.0 SQL Injection via genre.php
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the genre parameter. Attackers can send GET requests to genre.php with crafted SQL payloads in the genre parameter to extract sensitive database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiopmsd
product: AiOPMSD Final
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:23.765Z
CVE-2018-25420 AiOPMSD Final 1.0.0 SQL Injection via watch.php
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Aiopmsd
product: AiOPMSD Final
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:24.506Z
CVE-2018-25421 Open STA Manager 2.3 Arbitrary File Download via Path Traversal
Open STA Manager 2.3 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by manipulating the file parameter. Attackers can send GET requests to modules/backup/actions.php with op=getfile and traverse directories using ../ sequences to access sensitive system files.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Openstamanager
product: Open STA Manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:25.265Z
CVE-2018-25422 MOGG web simulator Script All Version SQL Injection via play.php
MOGG web simulator Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the id parameter. Attackers can send GET requests to play.php with crafted SQL payloads in the id parameter to extract sensitive database information including usernames and other data.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: spider312
product: MOGG web simulator Script
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Meisam Monsef - meisamrce@gmail.com - @meisamrce -
Published: 2026-05-30T14:55:26.042Z
CVE-2018-25423 Arm Whois 3.11 Denial of Service via Buffer Overflow
Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a malicious buffer of 700 bytes into the IP address or domain input field to trigger a denial of service condition.
Problem types: cwe_id: CWE-120
description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Armcode
product: Arm Whois
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Yair Rodríguez Aparicio
Published: 2026-05-30T14:55:26.966Z
CVE-2018-25424 Gate Pass Management System 2.1 SQL Injection via login-exec.php
Gate Pass Management System 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the login and password parameters. Attackers can submit crafted POST requests to login-exec.php with SQL injection payloads in form parameters to authenticate without valid credentials and gain access to the application.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Livebms
product: Gate Pass Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:27.924Z
CVE-2018-25425 Yot CMS 3.3.1 SQL Injection via aid and cid Parameters
Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid and cid parameters. Attackers can send GET requests to index.php with crafted SQL payloads in the aid or cid parameters to extract database information including table and column names.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Yot
product: Yot CMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:28.708Z
CVE-2018-25426 WinMTR 0.91 Denial of Service via Buffer Overflow
WinMTR 0.91 contains a denial of service vulnerability that allows attackers to crash the application by sending a malformed payload file containing a large buffer of repeated characters. Attackers can create a specially crafted input file with 238 bytes of data to trigger a buffer overflow condition that causes the application to crash.
Problem types: cwe_id: CWE-120
description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Winmtr
product: WinMTR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-05-30T14:55:29.422Z
CVE-2018-25427 Arm Whois 3.11 Buffer Overflow via SEH Overwrite
Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception handler and gain command execution when the application processes the input.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
Affected products: vendor: Armcode
product: Arm Whois
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Yair Rodríguez Aparicio (0-day DoS exploit), Semen Alexandrovich Lyhin (1-day fully working exploit)
Published: 2026-06-01T21:00:18.785Z
CVE-2018-25428 Paroiciel 11.20 SQL Injection via tRecIdListe Parameter
Paroiciel 11.20 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the tRecIdListe parameter. Attackers can send GET requests to the trec.php endpoint with crafted SQL payloads to extract database information including table and column names.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Paroiciel
product: Paroiciel
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-06-01T21:00:19.545Z
CVE-2018-25429 Paroiciel 11.20 SQL Injection via zProIdPro Parameter
Paroiciel 11.20 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the zProIdPro parameter. Attackers can send GET requests to zpro.php with crafted SQL payloads in the zProIdPro parameter to extract sensitive database information including usernames, databases, and version details.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Paroiciel
product: Paroiciel
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ihsan Sencan
Published: 2026-06-01T21:00:20.226Z