BIT-MARIADB-MIN-2021-46657

getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY...

CVE-2024-6438

A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the...

CVE-2024-9475

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the orderby parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2024-40614

EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajaxgetrows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting...

CVE-2022-24266

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/tablemanager/ via the orderby parameter...

CVE-2020-16165

The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list ascs and desc parameters...

CVE-2010-2826

SQL injection vulnerability in Cisco Wireless Control System WCS 6.0.x before 6.0.196.0 allows remote authenticated users to execute arbitrary SQL commands via vectors related to the ORDER BY clause of the Client List screens, aka Bug ID CSCtf37019...

SQL Injection

Overview sqlagg is a SQL aggregation tool Affected versions of this package are vulnerable to SQL Injection due to unsanitized user input in the ORDER BY clause. Remediation Upgrade sqlagg to version 0.13.0 or higher. References - GitHub Commit...

Carsale 安全漏洞

Carsale is an open source automobile sales management system from Hitout. A security vulnerability exists in Carsale version 1.0, which originates from an SQL injection in the orderBy parameter of the StoreController.java component, which may lead to the disclosure of sensitive information...

WordPress plugin coreActivity: Activity Logging SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

CVE-2025-1843

A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall/dao/ProductMapper.java. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploi...

CVE-2025-22765

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This issue affects WP Order By: from n/a through = 1.4.2...

Prolink DL-7203E 安全漏洞

The Prolink DL-7203E is a wireless router from Prolink USA. A security vulnerability exists in the Prolink DL-7203E version V4.0.0B05, which stems from a susceptibility to SQL injection attacks and allows an attacker to manipulate SQL queries by injecting malicious SQL code into the orderby...

WordPress GamiPress plugin <= 7.2.1 - Unauthenticated SQL Injection via orderby Parameter vulnerability

Unauthenticated SQL Injection via orderby Parameter vulnerability discovered by abrahack in WordPress Plugin GamiPress versions = 7.2.1...

CVE-2025-22765

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This issue affects WP Order By: from n/a through = 1.4.2...

WordPress plugin WP Order By 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-4685 · WordPress · Wp Order By

Name of the Vulnerable Software and Affected Versions: WP Order By versions 1.4.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This means an attacker can inject malicious scripts...

WordPress WP Order By Plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin WP Order By versions = 1.4.2...

GHSA-6Q3Q-6V5J-H6VG Querydsl vulnerable to HQL injection through orderBy

Summary The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repositoryhttps://github.com/querydsl/querydsl whe...

GHSA-M52V-24P8-654F SurrealDB has an Uncaught Exception Sorting Tables by Random Order

Sorting table records using an ORDER BY clause with the rand function as sorting mechanism could cause a panic due to relying on a comparison function that did not implement total order. This event resulted in a panic due to a recent change in Rust 1.81. Impact A client that is authorized to run...