CVE-2021-41845

A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007. The only affected versions are 10.9.000032 through 11.0.000006...

ThycoticCentrify Secret Server SQL注入漏洞

ThycoticCentrify Secret Server is a privileged access management software from Thycotic Corporation. A SQL injection vulnerability exists in ThycoticCentrify Secret Server, which arises from a database-based application that lacks validation of externally entered SQL statements. An attacker can...

Online-Food-Ordering-Web-App SQL注入漏洞

Online-Food-Ordering-Web-App is an open source online food ordering system website by the individual developer Kaushik Jadhav. Online-Food-Ordering-Web-App suffers from a SQL injection vulnerability that stems from an error- and time-based unauthenticated SQL blind injection vulnerability in...

PuneethReddyHc Online Shopping System Advanced SQL注入漏洞

PuneethReddyHc Online Shopping System Advanced is an open source online shopping system from the individual developers at Puneeth Reddy HC in India. A SQL injection vulnerability exists in PuneethReddyHc Online Shopping System Advanced, which originates in the /action.php prId parameter...

Sourcecodester Hotel and Lodge Management System SQL注入漏洞

SourceCodester Hotel and Lodge Management System is a hotel and lodge management system. SourceCodester Hotel and Lodge Management System suffers from a SQL injection vulnerability that can be exploited by an attacker to execute arbitrary SQL commands via email parameters...

FlameCMS SQL注入漏洞

FlameCMS is an open source PHP-based content management system CMS. A SQL injection vulnerability exists in FlameCMS version 3.3.5. An attacker can exploit this vulnerability to cause SQL injection with the help of the id parameter in masterarticle.php...

Gila CMS SQL注入漏洞

Gila CMS is an open source content management system CMS based on PHP and MySQL. Gila CMS version 1.11.4 suffers from a SQL injection vulnerability that can be exploited by an attacker via the $GET parameter in /src/core/controllers/cm.php...

CVE-2021-24606

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+...

CVE-2021-24396

A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24399

The checkorder function of The Sorter WordPress plugin through 1.0 uses an areaid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24606

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+...

Zoho Corporation ManageEngine OpManager SQL注入漏洞

Zoho Corporation ManageEngine OpManager is a comprehensive network monitoring software from Zoho Corporation, USA. It is used to manage routers, firewalls, servers, switches and printers. Zoho ManageEngine OpManager suffers from an SQL injection vulnerability that arises from insufficient cleanin...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on PHP and MySQL servers. A SQL injection vulnerability exists in WP Domain Redirect WordPress plugin 1.0 and earlier versions, whi...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress plugin SEO, which stems from the pageid GET...

WordPress 插件 SQL注入漏洞

WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin Support Board suffers from a SQL injection vulnerability that originates when the Support Board WordPress plugin fails to translate multiple POST parameters e.g., status code, department, user id, session id...

Metinfo MetInfo SQL注入漏洞

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. MetInfo 7.0.0 version of the existence of SQL injection vulnerability,...

CVE-2021-38324

The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the /user/shortcodes.php file which allows attackers to retrieve information contained in a site's database, in versions up to and including 1.5.3...

CVE-2021-36299

Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying speciall...

CVE-2021-40814

The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection...

The vulnerability of the `id` parameter in e-commerce web applications, as identified by SourceCoder in the “Online Shopping Alphaware” project, relates to the failure to protect the SQL query structure. This vulnerability allows attackers to execute arbitrary SQL commands and gain access to confidential data.

The vulnerability of the id parameter in e-commerce web applications developed by SourceCodester Online Shopping Alphaware is related to the failure to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL commands and gain access to confidenti...