SQL Injection Vulnerability in UFIDA NC of UFIDA Network Technology Co.

UFIDA NC is a large erp enterprise management system and e-commerce platform. A SQL injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive database information...

CVE-2024-12067

The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'bookingitinerary' parameter of the 'wptravelgetbookingdata' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied...

SQL Injection Vulnerability in Hunan Zhonghe Baiyi Information Technology Co.

Hunan Zhonghe Baiyi Information Technology Co., Ltd referred to as: Baiyi Cloud was founded in 2017 is a national high-tech enterprise focusing on digital R&D and services in the field of real estate. Hunan Zhonghe Baiyi Information Technology Co. Ltd Capital Management Cloud has a SQL injection...

CVE-2024-11726

CVE-2024-11726 affects the BookingPress (Appointment Booking Calendar Plugin and Scheduling Plugin) for WordPress. The flaw is an SQL Injection in the shortcodes context: the category parameter of the bookingpress_form shortcode is inadequately escaped, allowing an authenticated user with Contrib...

CVE-2024-11711: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'resumeid' parameter in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-51165

SQL injection vulnerability in JEPAAS7.2.8, via /je/rbac/rbac/loadLoginCount in the dateVal parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB...

CVE-2024-51165

A SQL injection vulnerability exists in JEPAAS version 7.2.8 within the /je/rbac/rbac/loadLoginCount API endpoint. Specifically, the dateVal parameter fails to properly neutralize special elements used in SQL commands. A remote attacker can submit a specially crafted query to retrieve all informa...

CVE-2024-51165

SQL injection vulnerability in JEPAAS7.2.8, via /je/rbac/rbac/loadLoginCount in the dateVal parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB...

SQL Injection Vulnerability in U8 Cloud of UFIDA Network Technology Co.

U8 Cloud is a set of enterprise Internet application design concepts based on Internet application, business collaboration, and network transactions, providing growing enterprises with a cloud ERP total solution integrating people, property and customers, production, supply and marketing. A SQL...

SQL Injection Vulnerability in UFIDA NC of UFIDA Network Technology Co. Ltd (CNVD-C-2024-947797)

UFIDA NC is a large erp enterprise management system and e-commerce platform. A SQL injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive database information...

WordPress plugin Tutor LMS SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

SQL Injection Vulnerability in the Integrated Management Information System of Shanghai Jinhui Software Co.

Shanghai Jinhui Software Co., Ltd. is a professional service provider focusing on digital intelligence in the engineering and construction industry design enterprises, engineering enterprises, owner units, government agencies. Shanghai Jinhui Software Co., Ltd. comprehensive management informatio...

SQL Injection Vulnerability in UFIDA NC of UFIDA Network Technology Co.

UFIDA NC is a large erp enterprise management system and e-commerce platform. A SQL injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive database information...

CVE-2024-9925

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

CVE-2024-9925

CVE-2024-9925 describes a SQL injection in QPLANT SF 1.0 by TAI Smart Factory. The vulnerability allows a remote attacker to exfiltrate all database information by crafting a SQL payload against the email parameter on the RequestPasswordChange endpoint. Impact is high (confidentiality, integrity,...

CVE-2024-9925 SQL injection in QPLANT by TAI Smart Factory

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

CVE-2024-9925 SQL injection in QPLANT by TAI Smart Factory

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

CVE-2024-9925: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

CVE-2024-9022: Improper Neutralization of Special Elements used in an SQL Command

The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2024-8621: Improper Neutralization of Special Elements used in an SQL Command

The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'maxword' attribute of the 'quranverse' shortcode in all versions up to, and including, 2024.08.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...