SQL Injection Vulnerability Patched in RSS Aggregator by Feedzy WordPress Plugin

🎉 Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through February 29th, 2024 when you opt to have Wordfence handle responsible disclosure! On February 1st, 2024, during our second Bug Bounty...

Important: redis6

Issue Overview: Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4. CVE-2023-41056...

Sql injection

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

SQL Injection Vulnerability in Data Leakage Protection (DLP) System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-13698)

Beijing Yisetong Technology Development Co., Ltd. is a domestic data security, network security and security services provider of three major business. A SQL injection vulnerability exists in the Data Leakage Protection DLP system of Beijing Yisetong, which can be exploited by attackers to obtain...

PostgreSQL Security Vulnerabilities

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features such as foreign keys, triggers, views, and more. A security vulnerability exists in PostgreSQL. An attacker can exploi...

CVE-2024-24811 Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution

SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version...

PT-2024-1634

Name of the Vulnerable Software and Affected Versions Vinchin Backup & Recovery version 7.2 Description The issue is related to the use of default credentials in Vinchin Backup & Recovery. This could allow a remote attacker to elevate their privileges. Recommendations For Vinchin Backup & Recover...

Delhivery Logistics Courier <= 1.0.107 - Authenticated (Subscriber+) SQL Injection

Description The Delhivery Logistics Courier plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.107 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-38738

CVE-2023-38738 affects IBM OpenPages with Watson versions 8.3 and 9.0, where Native authentication may yield weaker password security. Attacker with OpenPages DB access could potentially access other OpenPages accounts due to this weakness. IBM remediation is to switch password storage from symme...

pTypeConverter <= 0.2.8.1 - Authenticated (Editor+) SQL Injection

Description The pTypeConverter plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 0.2.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers...

Sql injection

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

Kashipara Food Management System SQL Injection Vulnerability (CNVD-2024-13468)

Kashipara Food Management System is a food management system from Kashipara. A SQL injection vulnerability exists in Kashipara Food Management System version 1.0, which is caused by a lack of validation of the id parameter of the itemeditsubmit.php file against externally entered SQL statements,...

Kashipara Food Management System SQL Injection Vulnerability (CNVD-2024-13472)

Kashipara Food Management System is a food management system from Kashipara. A SQL injection vulnerability exists in Kashipara Food Management System version 1.0, which stems from a lack of validation of the printid parameter of itemBillPdf.php against external SQL input, and can be exploited by ...

CVE-2023-50862

This CVE affects Travel Website v1.0. The vulnerability is an unauthenticated SQL Injection in the booking.php resource, triggered by the hotelIDHidden parameter where input is not properly validated and is sent unfiltered to the database. Impact is described as high for confidentiality, integrit...

Sql injection

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partylisteditsubmit.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-49658 Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bankdetails' parameter of the partysubmit.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-49622 Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the materialbill.php?action=itemRelation resource does not validate the characters received and they are sent unfiltered to the database...

PT-2023-31686 · Squirrly · Squirrly Seo - Advanced Pack

Name of the Vulnerable Software and Affected Versions: Squirrly SEO - Advanced Pack versions through 2.3.8 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection'. This allows for potential exploitation by injecting...

My Calendar < 3.4.22 - Unauthenticated SQL Injection

Description The My Calendar plugin for WordPress is vulnerable to blind|generic|time-based SQL Injection via the 'from' and 'to' parameters of the '/my-calendar/v1/events' rest route in all versions up to, and including, 3.4.21 due to insufficient escaping on the user supplied parameter and lack ...

CVE-2023-48723

CVE-2023-48723 is flagged as withdrawn by the CNA. In the connected PT-2023-30926 entry, the affected software is Student Result Management System v1.0, with an unauthenticated SQL Injection vulnerability in add_results.php where the rno parameter is not validated and is sent unfiltered to the da...