CVE-2015-1400

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/130179/NPDS-CMS-Revolution-13-SQL-Injection.htmlExploit
http://websecgeeks.com/npds-cms-sql-injection/Exploit
http://www.npds.org/viewtopic.php?topic=26189&forum=12Vendor Advisory
http://www.npds.org/viewtopic.php?topic=26233&forum=12Vendor Advisory
http://packetstormsecurity.com/files/130179/NPDS-CMS-Revolution-13-SQL-Injection.htmlExploit
http://websecgeeks.com/npds-cms-sql-injection/Exploit
http://www.npds.org/viewtopic.php?topic=26189&forum=12Vendor Advisory
http://www.npds.org/viewtopic.php?topic=26233&forum=12Vendor Advisory

Timeline

Published: Feb 3, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-14019.8Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.CVE-2015-14024.3Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbit CVE-2015-14037.5SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL com CVE-2015-14044.3Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inje CVE-2015-14057.5SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary CVE-2015-14147.8Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denia CVE-2015-14152.1The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the G CVE-2015-14167.8Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU p CVE-2015-14177.5The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9 CVE-2015-14187.8The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3,CVE-2015-14195.0Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to CVE-2015-14201.9Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size