CVE-2024-1874

CVE-2024-1874 Prova di concetto per CVE-2024-1874 Iniezione di comandi tramite il parametro $command di tipo array di procopen bypass della correzione di CVE-2024-1874 La CVE: Nelle versioni di PHP 8.1. precedenti a 8.1.29, 8.2. precedenti a 8.2.20, 8.3. precedenti a 8.3.8, la correzione per...

CVE-2024-3217-POC

CVE-2024-3217-POC Mitre Beschreibung Das WP Directory Kit Plugin für WordPress ist anfällig für SQL-Injection über die Parameter 'attributevalue' und 'attributeid' in allen Versionen bis einschließlich 1.3.0. Dies liegt an unzureichender Maskierung der benutzergesteuerten Parameter und fehlender...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE CVSS Type Auth https://t.me/FreeToolsCpa CVE file In Group Overview Field Value CVE ID CVE-2026-5513 Vulnerability Stored Cross-Site Scripting XSS...

CVE-2024-24576-PoC

CVE-2024-24576 PoC Die APIs Command::arg und Command::args geben in ihrer Dokumentation an, dass die Argumente unverändert an den gestarteten Prozess übergeben werden, unabhängig vom Inhalt der Argumente, und nicht von einer Shell ausgewertet werden. Das bedeutet, dass es sicher sein sollte, nich...

cve-2020-7247

cve-2020-7247 Titolo exploit: OpenSMTPD 6.6.2 - Esecuzione di codice remoto. La nuova data: 2020-01-29. Autore exploit: 1F98D. Autore originale: Qualys Security Advisory. Homepage del fornitore: https://www.opensmtpd.org/. Link del software:...

CVE-2026-78468

...

CVE-2026-78468

FluentCRM Pro for WordPress (all versions up to and including 3.1.12 ) is vulnerable to SQL Injection caused by insufficient escaping of a user-supplied parameter and lack of sufficient preparation on an existing SQL query. An authenticated attacker with Author-level or higher access can append a...

EUVD-2026-65579

The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-65459

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-77824

Media Sweep – WordPress Media Cleaner (all versions up to and including 1.1.3 ) is affected by a SQL Injection vulnerability in the 'fields' parameter of its REST API. The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper query preparation, as seen in...

CVE-2026-78568

The Total Donations plugin for WordPress is vulnerable to unauthenticated SQL Injection in all versions up to and including 2.0.5 . The root cause is insufficient escaping on a user-supplied parameter combined with lack of sufficient preparation on the existing SQL query, allowing an attacker to ...

Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 Free and = 2.27.4 Premium due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78470

WP Project Manager Pro is a WordPress plugin vulnerable to SQL Injection in all versions up to and including 4.0.1 . The root cause is insufficient escaping on a user-supplied parameter combined with a lack of prepared statements in the existing SQL query. An authenticated attacker with Subscribe...

EUVD-2026-65299

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia for WordPress, BuddyPress and bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...

CVE-2023-32590

CVE-2023-32590 Subscribe to Category = 2.7.4 - बिना प्रमाणीकरण के SQL इंजेक्शन विवरण Subscribe to Category प्लगइन वर्डप्रेस के लिए संस्करण 2.7.4 और उससे पहले के संस्करणों में SQL इंजेक्शन के प्रति संवेदनशील है, क्योंकि उपयोगकर्ता द्वारा प्रदान किए गए पैरामीटर पर अपर्याप्त एस्केपिंग और मौजूदा SQL...

CVE-2024-55988

CVE-2024-55988 Navayan CSV Export = 1.0.9 - SQL Injection non autenticata Descrizione Il plugin Navayan CSV Export per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 1.0.9 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di una...

CVE-2024-55982

CVE-2024-55982 Share Buttons – Social Media = 1.0.2 - SQL Injection non autenticata Descrizione Il plugin Share Buttons – Social Media per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 1.0.2 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della...

CVE-2024-55978

CVE-2024-55978 Code Generator Pro = 1.2 - Nicht authentifizierte SQL-Injection Beschreibung Das WordPress-Plugin Code Generator Pro ist in Versionen bis einschließlich 1.2 anfällig für SQL-Injection, da der vom Benutzer bereitgestellte Parameter unzureichend maskiert wird und die bestehende...