CVE-2024-1711: Improper Neutralization of Special Elements used in an SQL Command

The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.9.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-2592

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/person/picshow.php, in the 'personid' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

CVE-2024-2586: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/index.php, in the 'username' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

CVE-2024-2584: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/selectsend.php, in the 'sdindex' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

CVE-2024-2590: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/mail/main/selectsend.php, in the 'sdindex' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

PT-2024-21176

Name of the Vulnerable Software and Affected Versions AMSS++ version 4.31 Description The issue allows SQL injection through the "/amssplus/modules/book/main/bookdetail khet person.php" endpoint, in multiple parameters. This could allow a remote attacker to send a specially crafted SQL query to t...

CVE-2024-2591: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetailgroup.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

CVE-2024-2589: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetailschoolperson.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in th...

PT-2024-21151

Name of the Vulnerable Software and Affected Versions AMSS++ version 4.31 Description The issue allows SQL injection through the "/amssplus/modules/book/main/select send.php" API endpoint, specifically in the sd index parameter. This could enable a remote attacker to send a specially crafted SQL...

CVE-2024-1793: Improper Neutralization of Special Elements used in an SQL Command

The AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 7.3.14 due to insufficient escaping on the user supplied parameter an...

CVE-2024-1203: Improper Neutralization of Special Elements used in an SQL Command

The Conversios – Google Analytics 4 GA4, Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-0594: Improper Neutralization of Special Elements used in an SQL Command

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parameter of the wpasgetusers action in all versions up to, and including, 6.1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient...

SQL Injection Vulnerability in Ruiyou Tianyi Application Virtualization System

Xi'an Ruiyou Information Technology Co., Ltd. is a professional virtualization and cloud computing solution provider. A SQL injection vulnerability exists in Ruiyou Tianyi Application Virtualization System, which can be exploited by attackers to obtain database information and execute commands...

CVE-2020-26630

A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a special payload in the 'Doctor Specialization' field under the 'Go to Doctors' tab after logging in as an admin...

CVE-2020-26627: Improper Neutralization of Special Elements used in an SQL Command

A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a crafted payload entered into the 'Admin Remark' parameter under the 'Contact Us Queries - Unread Query' tab...

Tencent TDSQL 安全漏洞

Tencent tdsql is a distributed database from the Chinese company Tencent Tencent. An unspecified vulnerability exists in Tencent TDSQL, which can be exploited by an attacker to discover database information...

PT-2023-11749

Name of the Vulnerable Software and Affected Versions Hospital Management System version 4.0 Description A Time-Based SQL Injection issue was discovered, allowing an attacker to dump database information via a crafted payload entered into the Admin Remark parameter under the "Contact Us Queries -...

CVE-2023-5761: Improper Neutralization of Special Elements used in an SQL Command

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro due to insufficient escaping on the user supplied parameter and lack of sufficient...

Exploit for SQL Injection in Oretnom23 Customer_Support_System

CVE-2023-49547 Customer Support System 1.0 - SQL Injection L...

CVE-2023-5466: Improper Neutralization of Special Elements used in an SQL Command

The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...