2287 matches found
CVE-2024-3495-POC
CVE-2024-3495-POC The Country State City Dropdown CF7 WordPress plugin versions up to 2.7.2 is vulnerable to SQL Injection via 'cnt' and 'sid' parameters. Insufficient escaping and lack of preparation in the SQL query allow unauthenticated attackers to append queries, potentially extracting...
Premium Packages – Sell Digital Products Securely - SQL Injection
Premium Packages – Sell Digital Products Securely WordPress plugin = 6.2.0 contains a SQL injection caused by insufficient escaping of 'code' parameter in CouponCodes::find method, letting unauthenticated attackers extract sensitive database information via crafted SQL queries. id: CVE-2026-12800...
CVE-2025-71434
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/count...
CVE-2022-51023
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...
CVE-2024-58393
i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...
CVE-2019-25778
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...
EUVD-2025-211171
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/count...
CVE-2025-71434 Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/count...
CVE-2025-71434
Weaver E-cology versions 8.0 , 9.0 , and 10.0 (prior to 10.76 ) are vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists in the /api/doc/out/more/list endpoint via the elementmore parameter when srcType=2. Attackers can inject SQL commands through the doc_datefrom and doc...
CVE-2024-58393
The i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) is vulnerable to an SQL injection flaw. Unauthenticated attackers can manipulate database queries by sending GET requests to /product-details.php using boolean-based , stacked , or time-based SLEEP payloads in the 'id' paramete...
EUVD-2024-55820
i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...
EUVD-2022-56067
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...
CVE-2022-51023
PHPOK versions 4.5.000 before 5.4.081 are vulnerable to an SQL injection vulnerability. The root cause is the improper handling of the sort parameter , which allows unauthenticated attackers to manipulate ORDER BY clauses. By sending GET requests to /api.php?c=project&f=index using extractvalue p...
EUVD-2019-20209
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...
CVE-2026-114664 Frappe before 16.33.0 Blind SQL Injection via get_events
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...
CVE-2026-114664
The Frappe Framework before version 16.33.0 is vulnerable to a blind SQL injection in the frappe.desk.doctype.event.event.get_events method. The root cause is the failure to properly neutralize user-supplied input before it is included in SQL queries. Authenticated attackers can provide crafted i...
EUVD-2026-107699
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...
VulnCheck KEV: CVE-2019-25778
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...
CVE-2024-58393: Improper Neutralization of Special Elements used in an SQL Command
i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...
VulnCheck KEV: CVE-2022-51023
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...