CVE-2013-3638

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'pathes' parameter in 'categories.php'.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/60511Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/84928VDB Entry
http://www.securityfocus.com/bid/60511Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/84928VDB Entry

Timeline

Published: Feb 6, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-36394.3Multiple cross-site scripting (XSS) vulnerabilities in Xaraya 2.4.0-b1 and earlier allow remote attackers to inject arbitrary web script or CVE-2013-36404.3Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 12 and Pro Advanced before 12 allows re CVE-2013-36415.8The Pizza Hut Japan Official Order application before 1.1.1.a for Android does not verify X.509 certificates from SSL servers, which allows CVE-2013-36424.3The Angel Browser application 1.47b and earlier for Android 1.6 through 2.1, 1.62b and earlier for Android 2.2 through 2.3.4, 1.68b and earl CVE-2013-36434.3The Galapagos Browser application for Android does not properly implement the WebView class, which allows attackers to obtain sensitive info CVE-2013-364410.0Unspecified vulnerability in JustSystems Ichitaro 2006 through 2013; Ichitaro Pro through 2; Ichitaro Government 6, 7, and 2006 through 2010 CVE-2013-36454.3Cross-site scripting (XSS) vulnerability in the Orchard.Comments module in Orchard before 1.6.1 allows remote attackers to inject arbitrary CVE-2013-36466.8The Cybozu Live application before 2.0.1 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive informa CVE-2013-36476.8The WebView class in the Cybozu Live application before 2.0.1 for Android allows attackers to execute arbitrary JavaScript code, and obtain CVE-2013-36484.3Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MAIL before 6.7, when Internet Explorer 7 or earlier is used, allows remote attack CVE-2013-36494.3Cross-site scripting (XSS) vulnerability in KENT-WEB CLIP-MAIL before 3.4, when Internet Explorer 7 or earlier is used, allows remote attack CVE-2013-36505.0Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.