CVE-2022-40405

WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs...

CVE-2022-40405: Improper Neutralization of Special Elements used in an SQL Command

WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs...

PT-2022-26694

Name of the Vulnerable Software and Affected Versions WoWonder Social Network Platform version 4.1.4 Description The issue is related to a SQL injection vulnerability. It can be exploited via the offset parameter at the "requests.php?f=search&s=recipients" endpoint. Recommendations For WoWonder...

Authentication flaw

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...

CVE-2022-1753

Summary: CVE-2022-1753 affects WoWonder via /requests.php, where manipulating the group_id parameter enables posting messages in other groups. The vulnerability can be triggered remotely, with some sources noting authentication may be required. This indicates a broken access control condition in ...

CVE-2022-1753 WoWonder Group requests.php access control

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...

CVE-2022-1753: Improper Access Control

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...

PT-2022-14086

Name of the Vulnerable Software and Affected Versions WoWonder affected versions not specified Description A critical vulnerability was found in WoWonder, affecting the file /requests.php, which handles group messages. The manipulation of the group id argument allows posting messages in other...

CVE-2021-26935

In WoWonder 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the eventid parameter...

Sql injection

In WoWonder 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the eventid parameter...

CVE-2021-26935: Improper Neutralization of Special Elements used in an SQL Command

In WoWonder 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the eventid parameter...

PT-2021-17185

Name of the Vulnerable Software and Affected Versions: WoWonder versions prior to 3.1 Description: The issue allows remote attackers to gain access to the database by exploiting a SQL Injection vulnerability in the requests.php?f=search-my-followers endpoint via the event id parameter...

PT-2018-12222

Name of the Vulnerable Software and Affected Versions yTakkar Instagram-clone through 2018-04-23 Description The issue is related to inadequate XSS protection based on preg replace, allowing for XSS via an onmouseover payload in the edit requests.php file. Recommendations For yTakkar...

CVE-2009-2156: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Title field to requests.php, related to viewrequests.php; and 2 the Torrent Name field to torrents-upload.php, related to the logging o...