4236 matches found
Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection
The plugin does not escape the discountcode in one of its REST route available to unauthenticated users before using it in a SQL statement, leading to a SQL injection PoC https://example.com/?restroute=/pmpro/v1/checkoutlevelid=3code=%27%20%20union%20select%20sleep1%20--%20g...
CVE-2021-3860
JFrog Artifactory before 7.25.4 Enterprise+ deployments only, is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query...
CVE-2021-3860
JFrog Artifactory before 7.25.4 Enterprise+ deployments only, is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query...
CVE-2021-3860
JFrog Artifactory before 7.25.4 Enterprise+ deployments only, is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query...
Sql injection
JFrog Artifactory before 7.25.4 Enterprise+ deployments only, is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query...
PT-2021-22238 · Jfrog · Jfrog Artifactory
Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.25.4 Description: The issue is related to Blind SQL Injection, which can be exploited by a low-privileged authenticated user due to incomplete validation when performing an SQL query. Recommendations: For...
CVE-2021-3860
JFrog Artifactory before 7.25.4 Enterprise+ deployments only, is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query...
CVE-2021-3860
JFrog Artifactory before 7.25.4 Enterprise+ deployments only, is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query...
CVE-2021-24946 Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue...
GHSA-6XXJ-GCJQ-WGF4 SQL injection in prestashop/prestashop
Impact Blind SQLi using Search filters with orderBy and sortOrder parameters Patches The problem is fixed in 1.7.8.2...
CVE-2021-40578
CVE-2021-40578 affects PayPal Free Source Code 1.0 Online Enrollment Management System. The vulnerability is an Authenticated Blind & Error-based SQL injection via the IDNO parameter, enabling an attacker with valid credentials to access sensitive data and execute arbitrary SQL commands. Document...
CVE-2021-43789
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with orderBy and sortOrder parameters. The problem is fixed in version 1.7.8.2...
Sql injection
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with orderBy and sortOrder parameters. The problem is fixed in version 1.7.8.2...
CVE-2021-43789
CVE-2021-43789 affects PrestaShop prior to 1.7.8.2. The vulnerability is a blind SQL injection in search filters using the responsible parameters, specifically through the fields “orderBy” and “sortOrder.” The issue is fixed in version 1.7.8.2. Public references and OSV/GHSA entries reiterate the...
CVE-2021-25784
Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article...
Sql injection
Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article...
Sql injection
Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search...
CVE-2021-25784
Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article...
CVE-2021-25783
Taocms v2.5Beta5 has a blind SQL injection vulnerability in the Article Search function. The issue is documented across multiple sources as a SQL injection flaw in TaoCMS, with no public exploitation details provided in these connected entries. Per the CVE record, the vulnerability carries a CVSS...
