392 matches found
CVE-2019-17671
＃CVE-2019-17671 ＃url + /？static = 1＆order = asc...
CVE-2024-8484
CVE-2024-8484 REST API TO MiniProgram = 4.7.1 - 未認証SQLインジェクション root@kitploit: CVE: CVE-2024-8484 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Score: 7.5 Slugs: rest-api-to-miniprogram 説明: WordPress用プラグイン「REST API TO...
MISP < 2.5.37 - SQL Injection
MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation. id: CVE-2026-44381 info: name: MISP 2.5.37 - SQL Injection author: malcha severity: medium description: | MISP befo...
CVE-2024-33911
The School Management 10.3.4 - 인증 후 SQL 인젝션 익스플로잇 제목: The School Management 10.3.4 - Post-Authenticated SQL Injection 날짜: 2024년 4월 29일 익스플로잇 작성자: Ivan Spiridonov xbz0n 공급업체 홈페이지: https://theschool-management.com 버전: 10.3.4 테스트 환경: Ubuntu 22.04 CVE: CVE-2024-33911 취약점 The School Management 플러그인, 버...
CVE-2024-8275
CVE-2024-8275 CVE-2024-8275는 WordPress 플러그인 The Events Calendar에서 발견된 심각한 SQL 인젝션 취약점입니다. 이 취약점은 버전 6.6.4 이하에 영향을 미칩니다. 문제는 tribehasnextevent 함수의 'order' 매개변수에 대한 이스케이핑이 불충분하여 발생합니다. 입력 값이 적절히 검증되지 않았기 때문에 인증되지 않은 공격자가 악의적인 SQL 쿼리를 추가하여 데이터베이스에 저장된 민감한 정보에 접근할 수 있습니다. 1- Python 설치: Python 3이 설치되어...
CVE-2022-0439
CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ 블라인드 SQL 인젝션 필수 사항 sqlmap이 설치되어 있어야 하며, subscriber+ 권한을 가진 유효한 사용자 이름과 비밀번호가 필요합니다. 사용법 root@kitploit: usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w...
CVE-2022-32132
osTicket 지원 티켓팅 시스템용 CVE-2022-32132 반사형 XSS: root@kitploit: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...
CVE-2026-18884 WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
EUVD-2026-66333
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
EUVD-2026-54308
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
CVE-2026-67689
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
CVE-2026-67689
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
CVE-2026-67689
CVE-2026-67689 concerns FineAdmin V1.0 where the vulnerability arises in the paginated list endpoints through the field and order parameters, enabling SQL injection via unsafely constructed ORDER BY clauses. Connected sources describe that FineAdmin.Mvc’s GetListByFilter()/GetPageUnite() concaten...
CVE-2026-67689
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
CVE-2026-11920
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
EUVD-2026-53289
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-11920
CVE-2026-11920 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.7.9. The vulnerability is a time-based SQL Injection in the query path that uses the user-supplied, insufficiently escaped parameters in the SQL statement, triggered when b...
CVE-2026-11920
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-11920 JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...