CVE-2024-12031 Advanced Floating Content <= 3.8.2 - Authenticated (Subscriber+) SQL Injection

The Advanced Floating Content plugin for WordPress is vulnerable to SQL Injection via the 'floatingcontentduplicatepost' function in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2024-12784

A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been classified as critical. Affected is an unknown function of the file editbill.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2024-12025 Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection

The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

SQL Injection Vulnerability in OA System of Jiangsu Wave Information Consulting Co.

Jiangsu Wave Information Consulting Co. A SQL injection vulnerability exists in the OA system of Jiangsu Wave Information Consulting Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2024-8326 s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'scgetdetails' function. This makes it possible for...

CVE-2024-54931

A SQL Injection was found in /admin/deleteevent.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter...

CVE-2024-54924

A SQL Injection was found in /admin/editcontent.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the title and content parameters...

CVE-2024-54924

A SQL Injection was found in /admin/editcontent.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the title and content parameters...

IBM Db2 安全漏洞

IBM Db2 is a relational database management system from International Business Machines IBM. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM Db2 suffers from a denial-of-service vulnerability that can be exploited by an attacker to cause a...

CVE-2024-54141 phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database ie postgreSQL server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0...

CVE-2024-11732 BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter

The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to, and including, 2.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

VulnCheck KEV: CVE-2000-0325

The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability...

Job Recruitment 安全漏洞

Job Recruitment by code-projects is a job portal project developed using PHP, CSS, JavaScript, and MySQL technologies. A security vulnerability exists in Job Recruitment version 1.0, which originates from an SQL injection vulnerability in the e parameter of the reset.php file...

CVE-2024-49017

SQL Server Native Client Remote Code Execution Vulnerability...

SQL Injection Vulnerability in UFIDA NC of UFIDA Network Technology Co.

UFIDA NC is a large erp enterprise management system and e-commerce platform. A SQL injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive database information...

UFIDA U8CRM suffers from SQL Injection Vulnerability (CNVD-2024-47765)

U8CRM is a Customer Relationship Management CRM software from UFIDA Software Corporation designed to help organizations improve customer service and sales management efficiency. A SQL injection vulnerability exists in UFIDA U8CRM, which can be exploited by attackers to obtain sensitive informatio...

Vulnerability of the Server: Thread Pooling component of the Oracle MySQL Server database management system. This allows attackers to cause service interruptions.

The vulnerability of the Server: Thread Pooling component of the Oracle MySQL Server database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions using the network MySQL protocol...

Vulnerability of the Server component: The Optimizer component of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

PT-2024-33087 · Unknown · Lylme Spage

Name of the Vulnerable Software and Affected Versions: LyLme Spage versions prior to 1.6.1 Description: The issue allows for SQL Injection via the "/admin/group.php" API endpoint. Recommendations: For versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue...

Vulnerability of the Server component: The Oracle MySQL Server database management system, which allows attackers to cause service interruptions.

The vulnerability of the Oracle MySQL Server component of the database management system involves insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...