WordPress Data Tables Generator by Supsystic plugin <= 1.9.96 - SQL injection (SQLi) vulnerability

SQL injection SQLi vulnerability found by Erik David Martin in WordPress Data Tables Generator by Supsystic plugin versions = 1.9.96. Solution Update the WordPress Data Tables Generator by Supsystic plugin to the latest available version at least 1.9.97...

WordPress Supsystic Data Tables Generator 1.9.96 XSS / SQL Injection

Exploit Title: WordPress Plugin Supsystic Data Tables Generator 1.9.96 - Multiple Vulnerabilities Date: 24/07/2020 Exploit Author: Erik David Martin Vendor Homepage: https://supsystic.com/ Software Link: https://downloads.wordpress.org/plugin/data-tables-generator-by-supsystic.1.9.96.zip Category...

Data Tables Generator by Supsystic < 1.10.1 - Authenticated Stored Cross-Site Scripting (XSS)

The "Editor" tab under the "Tables" section is vulnerable to stored XSS. It is possible to store XSS in all input fields as the code does not sanitise any of the user input. PoC Open a Table, go to the editor and enter a payload below in a cell, then save the Table = 1.9.99 - = 1.10.0 -...

WordPress Plugin Supsystic Data Tables Generator 1.9.96 - Multiple Vulnerabilities

Exploit Title: WordPress Plugin Supsystic Data Tables Generator 1.9.96 - Multiple Vulnerabilities Date: 24/07/2020 Exploit Author: Erik David Martin Vendor Homepage: https://supsystic.com/ Software Link: https://downloads.wordpress.org/plugin/data-tables-generator-by-supsystic.1.9.96.zip Category...

CVE-2020-8520

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8521

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8519

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Sql injection

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8519

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Sql injection

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Sql injection

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8521

CVE-2020-8521 describes an SQL injection in Phpzag’s DataTables Records.php (used for live add/edit/delete of records via Ajax). The vulnerability stems from unsafe handling of the start and length parameters in Records.php, enabling an attacker to manipulate SQL queries. Multiple sources (NVD, R...

CVE-2020-8521

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8519

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8519

CVE-2020-8519 is a SQL injection in SpryMedia DataTables (Records.php) used by Phpzag’s live data tables (Ajax PHP/MySQL). The vulnerability arises from an unsafe search parameter in Records.php, enabling manipulation of table records. Documented scores indicate high to critical severity (CVSS v3...

WordPress Data Tables Generator by Supsystic Plugin < 1.9.92 Multiple Vulnerabilities

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2020-12076

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS...

CVE-2020-12075

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions...

CVE-2020-12075

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions...

Cross site scripting

The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS...