Description
Multiple SQL injection vulnerabilities in Avanset Visual CertExam Manager 3.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) Title, (2) File name, or (3) Candidate Name field.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/102414
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/65104
Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/869702
Scores
EPSS
0.0129
EPSS Percentile
67.3%
Details
CWE
CWE-89
Status
published
Products (19)
avanset/visual_certexam_manager
2.0
avanset/visual_certexam_manager
2.1
avanset/visual_certexam_manager
2.1.1
avanset/visual_certexam_manager
2.3
avanset/visual_certexam_manager
2.4
avanset/visual_certexam_manager
2.4.1
avanset/visual_certexam_manager
2.4.2
avanset/visual_certexam_manager
2.5
avanset/visual_certexam_manager
2.6
avanset/visual_certexam_manager
2.7
... and 9 more
Published
Jan 24, 2014
Tracked Since
Feb 18, 2026