CVE-2016-10114

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the "aWeb Cart Watching System for Virtuemart" extension before 2.6.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via vectors involving categorysearch and smartSearch.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jan 4, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-101159.8NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus deviceCVE-2016-101168.1NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus deviceCVE-2016-101177.8Firejail does not restrict access to --tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc.CVE-2016-101183.3Firejail allows local users to truncate /etc/resolv.conf via a chroot command to /.CVE-2016-101197.8Firejail uses 0777 permissions when mounting /tmp, which allows local users to gain privileges.CVE-2016-10128.8Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attCVE-2016-101207.8Firejail uses 0777 permissions when mounting (1) /dev, (2) /dev/shm, (3) /var/tmp, or (4) /var/lock, which allows local users to gain privilCVE-2016-101217.8Firejail uses weak permissions for /dev/shm/firejail and possibly other files, which allows local users to gain privileges.CVE-2016-101227.8Firejail does not properly clean environment variables, which allows local users to gain privileges.CVE-2016-101237.8Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges.CVE-2016-101248.6An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escapeCVE-2016-101258.1D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle attackers to spoof dev