19 matches found
CVE-2024-41302-Bookea-tu-Mesa-is-vulnerable-to-SQL-Injection
CVE-2024-41302-Bookea-tu-Mesa SQL इंजेक्शन के लिए संवेदनशील है Bookea-tu-Mesa SQL इंजेक्शन SQLi कमजोरी के प्रति संवेदनशील है। यह दोष हमलावरों को दुर्भावनापूर्ण SQL कमांड इंजेक्ट करने की अनुमति देता है जो डेटाबेस में हेरफेर कर सकते हैं, संभावित रूप से एप्लिकेशन की डेटा अखंडता और सुरक्षा से समझौता ...
CVE-2026-88854
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
CVE-2026-15439
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
EUVD-2026-76139
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
CVE-2026-15439
The GamiPress WordPress plugin (versions up to and including 7.9.7 ) is vulnerable to authenticated SQL injection via the q parameter in the wpForo integration AJAX action gamipress_wpforo_get_posts. The input is filtered only by $wpdb->esc_like() and interpolated directly into a single-quoted...
PT-2026-89895
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipress wpforo get posts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esc like and interpolated...
CVE-2026-52775
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...
CVE-2026-52775 YesWiki Authenticated SQL Injection in ReactionManager
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...
CVE-2026-52775
YesWiki (PHP wiki system) prior to version 4.6.6 is vulnerable to an authenticated SQL injection in ReactionManager::deleteUserReaction(). The {idreaction} and {id} URL path parameters are concatenated directly into a SQL LIKE clause without escaping, while a sibling code path correctly applies $...
CVE-2026-45073
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller...
YesWiki has Authenticated SQL Injection via ReactionManager
Summary YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. The parameters are concatenated directly into a SQL LIKE...
GHSA-4PF7-CC4R-G63H YesWiki has Authenticated SQL Injection via ReactionManager
Summary YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. The parameters are concatenated directly into a SQL LIKE...
PT-2026-57035
Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6 Description An issue exists in the ReactionManager::deleteUserReaction function where authenticated users can perform a SQL injection. This occurs because the idreaction and id URL path parameters are concatenat...
CVE-2026-34973
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages method in phpmyfaq/src/phpMyFAQ/Search.php uses realescapestring via escape to sanitize the search term before embedding it in LIKE clauses. However, realescapestring does not escape SQL LIKE...
GHSA-PVW4-P2JM-CHJM AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
Summary The remindMe.json.php endpoint passes $REQUEST'livescheduleid' through multiple functions without sanitization until it reaches Schedulercommands::getAllActiveOrToRepeat, which directly concatenates it into a SQL LIKE clause. Although intermediate functions new Liveschedule,...
CVE-2026-33651
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the remindMe.json.php endpoint passes $REQUEST'livescheduleid' through multiple functions without sanitization until it reaches Schedulercommands::getAllActiveOrToRepeat, which directly concatenates it into a SQL...
CVE-2019-20858
An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service CPU consumption via crafted characters in a SQL LIKE clause to an APIv4 endpoint...
CVE-2019-20858: Uncontrolled Resource Consumption
An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service CPU consumption via crafted characters in a SQL LIKE clause to an APIv4 endpoint...
PT-2020-10821
Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.15.0 Description An issue allows attackers to cause a denial of service CPU consumption via crafted characters in a SQL LIKE clause to an "APIv4 endpoint". Recommendations For versions prior to 5.15.0,...