228 matches found
CVE-2024-13496
The CVE-2024-13496 entry affects the GamiPress – Gamification WordPress plugin. It describes a time-based SQL Injection via the orderby parameter in all versions up to 7.3.1 due to insufficient escaping and query preparation, enabling unauthenticated attackers to append SQL and potentially read s...
CVE-2024-12615 Passwords Manager <= 1.4.8 - Authenticated (Subscriber+) SQL Injection
The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb-prefix value in several AJAX actions in all versions up to, and including, 1.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2024-52969
CVE-2024-52969 is an SQL injection in FortiSIEM Update/Create Case feature. Concrete details from connected PT-2025-2947 confirm the vulnerability affects FortiSIEM versions: 7.1.7 and below, 7.0.3 and below, 6.7.9 and below, 6.6.5 and below, 6.5.3 and below, and 6.4.4 and below. The root cause i...
CVE-2024-52969
An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below...
CVE-2024-52969
An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below...
CVE-2024-12157
CVE-2024-12157 details (WordPress Plugin: Popup – MailChimp, GetResponse and ActiveCampaign Intergrations) Affected product: Popup – MailChimp, GetResponse and ActiveCampaign Intergrations (WordPress plugin) Vulnerability: SQL Injection via the id parameter of the upc_delete_db_record AJAX action...
CVE-2024-12416 Woomotiv <= 3.6.1 - Unauthenticated SQL Injection
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to SQL Injection via the 'woomotivseenproducts.' cookie in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2024-12428
The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'orderuserlogindir' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
CVE-2024-11710
CVE-2024-11710 affects WordPress plugin WP Job Portal – A Complete Recruitment System for Company or Job Board website, vulnerable to SQL Injection via fieldfor, visibleParent and id parameters in all versions up to 2.2.2 due to insufficient escaping and poor query preparation. The vulnerability ...
CVE-2019-25221 Responsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2024-11460
The Verowa Connect plugin for WordPress is vulnerable to SQL Injection via the 'searchstring' parameter in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2024-10247 YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injection
The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2024-9887 Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection
The Login using WordPress Users WP as SAML IDP plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2024-9130
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...
OpenEMR 5.0.1 Patch 6 SQL Injection
require 'csv' This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenEMR 5.0.1 Patch 6 SQLi Dump', 'Description' = ' This module exploits a SQLi vulnerability found in OpenEMR version 5.0.1 Patch ...
CVE-2024-38289
TurboMeeting (R-HUB) versions through 8.x are affected by a boolean-based SQL injection in the Virtual Meeting Password (VMP) endpoint. The issue allows unauthenticated remote attackers to extract hashed passwords and authenticate via crafted SQL input. Affected software: RHUB TurboMeeting (up to...
CVE-2024-6338
The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
CVE-2024-6172
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied...
CVE-2024-3549 Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...