Sql injection

Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...

CVE-2020-8242: Improper Neutralization of Special Elements used in an SQL Command

Unsanitized user input in ExpressionEngine = 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute the attack...

PT-2022-9064

Name of the Vulnerable Software and Affected Versions ExpressionEngine versions prior to 5.4.0 Description The issue arises from unsanitized user input in the control panel member creation functionality, leading to an SQL injection. An attacker would need access to the member creation/admin contr...

Packet Tide ExpressionEngine security vulnerability

Packet Tide ExpressionEngine is an open source content management system CMS from Packet Tide USA. Packet Tide ExpressionEngine suffers from a SQL injection vulnerability that originates from unsanitized user input in ExpressionEngine = 5.4.0 Control Panel Member Creation, which can lead to SQL...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

PT-2022-15938

Name of the Vulnerable Software and Affected Versions S-CMS version 5.0 Description The issue is related to a SQL injection vulnerability in the member pay.php file via the O id parameter. This allows for potential exploitation by injecting malicious SQL code. Recommendations For S-CMS version 5....

S-CMS SQL Injection Vulnerability

S-CMS is a PHP and MySQL based Content Management System CMS from China's S-CMS Corporation. A SQL injection vulnerability exists in S-CMS, which originates from the product's failure to securely handle special characters in the Oid parameter in the memberpay.php file. The vulnerability can be...

FreeBSD : Gitlab -- multiple vulnerabilities (3507bfb3-85d5-11ec-8c9c-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3507bfb3-85d5-11ec-8c9c-001b217b3468 advisory. - An authorization logic error in the External Status Check API in GitLab EE affecting all...

CVE-2021-46377

There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.phpviewUser...

CSZ CMS SQL injection vulnerability

CSZ CMS is a PHP-based open-source content management system CMS.A SQL injection vulnerability exists in CSZ CMS 1.2.9, which can be exploited by attackers via cszcms/controllers/Member.php...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

WordPress Simple Membership plugin <= 4.0.8 - Arbitrary Member Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Member Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof Zając in WordPress Simple Membership plugin versions = 4.0.8. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.0.9...

Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF

The plugin does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=simplewpmembership=bulkdelete%5B0%5D=1%5B1%5D=2...

CVE-2022-0125

An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not verifying that a maintainer of a project had the right access to import members from a...

CVE-2022-0125

Removed by vendor...

PT-2021-10557

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: A Cross-Site Request Forgery CSRF issue exists in the /admin/index.php?lfj=member&action=editmember endpoint of Qibosoft, allowing attackers to add administrator accounts arbitrarily. Recommendations: For...

PT-2021-10555

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: A Cross-Site Request Forgery CSRF issue exists in the /member/post.php?job=postnew&step=post endpoint of the affected software, allowing attackers to force victim users into publishing new articles via a crafte...

CVE-2020-20943: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL...