2014 matches found
CVE-2024-24811 Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution
SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version...
PT-2024-1634
Name of the Vulnerable Software and Affected Versions Vinchin Backup & Recovery version 7.2 Description The issue is related to the use of default credentials in Vinchin Backup & Recovery. This could allow a remote attacker to elevate their privileges. Recommendations For Vinchin Backup & Recover...
Delhivery Logistics Courier <= 1.0.107 - Authenticated (Subscriber+) SQL Injection
Description The Delhivery Logistics Courier plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.107 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2023-38738
CVE-2023-38738 affects IBM OpenPages with Watson versions 8.3 and 9.0, where Native authentication may yield weaker password security. Attacker with OpenPages DB access could potentially access other OpenPages accounts due to this weakness. IBM remediation is to switch password storage from symme...
pTypeConverter <= 0.2.8.1 - Authenticated (Editor+) SQL Injection
Description The pTypeConverter plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 0.2.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers...
Sql injection
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
Kashipara Food Management System SQL Injection Vulnerability (CNVD-2024-13468)
Kashipara Food Management System is a food management system from Kashipara. A SQL injection vulnerability exists in Kashipara Food Management System version 1.0, which is caused by a lack of validation of the id parameter of the itemeditsubmit.php file against externally entered SQL statements,...
Kashipara Food Management System SQL Injection Vulnerability (CNVD-2024-13472)
Kashipara Food Management System is a food management system from Kashipara. A SQL injection vulnerability exists in Kashipara Food Management System version 1.0, which stems from a lack of validation of the printid parameter of itemBillPdf.php against external SQL input, and can be exploited by ...
CVE-2023-50862
This CVE affects Travel Website v1.0. The vulnerability is an unauthenticated SQL Injection in the booking.php resource, triggered by the hotelIDHidden parameter where input is not properly validated and is sent unfiltered to the database. Impact is described as high for confidentiality, integrit...
Sql injection
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partylisteditsubmit.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-49658 Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bankdetails' parameter of the partysubmit.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-49622 Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the materialbill.php?action=itemRelation resource does not validate the characters received and they are sent unfiltered to the database...
PT-2023-31686 · Squirrly · Squirrly Seo - Advanced Pack
Name of the Vulnerable Software and Affected Versions: Squirrly SEO - Advanced Pack versions through 2.3.8 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection'. This allows for potential exploitation by injecting...
My Calendar < 3.4.22 - Unauthenticated SQL Injection
Description The My Calendar plugin for WordPress is vulnerable to blind|generic|time-based SQL Injection via the 'from' and 'to' parameters of the '/my-calendar/v1/events' rest route in all versions up to, and including, 3.4.21 due to insufficient escaping on the user supplied parameter and lack ...
CVE-2023-48723
CVE-2023-48723 is flagged as withdrawn by the CNA. In the connected PT-2023-30926 entry, the affected software is Student Result Management System v1.0, with an unauthenticated SQL Injection vulnerability in add_results.php where the rno parameter is not validated and is sent unfiltered to the da...
CVE-2023-48717
The Connected document PT-2023-30920 documents an unauthenticated SQL Injection in Student Result Management System (SRMS) v1.0. The flaw is in add_classes.php where the class name parameter is not validated or filtered, and input is sent unfiltered to the database, enabling SQL injection. This c...
CVE-2023-45125
The CVE entry CVE-2023-45125 is connected to PT-2023-29424, which describes an Authenticated SQL Injection in Online Examination System version 1.0. The vulnerability arises because the time parameter in update.php is not validated and is sent unfiltered to the database. Impact is not detailed be...
WordPress Plugin Soledad SQL Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Soledad...
CVE-2023-48372
The CVE-2023-48372 entry pertains to ITPison OMICARD EDM. The SMS-related function has insufficient input validation, enabling an unauthenticated remote attacker to inject arbitrary SQL commands to access, modify, and delete database data. This is described across multiple connected records (NVD/...