CVE-2016-5048

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in chat/staff/default.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary SQL commands via the user name field.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/294272Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/92487Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/294272Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/92487Third Party Advisory, VDB Entry

Timeline

Published: Aug 26, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-50497.5Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot CVE-2016-50509.8Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading CVE-2016-50517.5OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.CVE-2016-50527.5OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.CVE-2016-50539.8OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.CVE-2016-50547.5OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.CVE-2016-50556.1OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.CVE-2016-50567.5OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.CVE-2016-50577.5OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.CVE-2016-50587.5OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.CVE-2016-50596.5OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/v CVE-2016-50606.1Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via