CVE-2022-24266

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/tablemanager/ via the orderby parameter...

CVE-2020-16165

The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list ascs and desc parameters...

CVE-2010-2826

SQL injection vulnerability in Cisco Wireless Control System WCS 6.0.x before 6.0.196.0 allows remote authenticated users to execute arbitrary SQL commands via vectors related to the ORDER BY clause of the Client List screens, aka Bug ID CSCtf37019...

SQL Injection

Overview sqlagg is a SQL aggregation tool Affected versions of this package are vulnerable to SQL Injection due to unsanitized user input in the ORDER BY clause. Remediation Upgrade sqlagg to version 0.13.0 or higher. References - GitHub Commit...

Carsale 安全漏洞

Carsale is an open source automobile sales management system from Hitout. A security vulnerability exists in Carsale version 1.0, which originates from an SQL injection in the orderBy parameter of the StoreController.java component, which may lead to the disclosure of sensitive information...

WordPress plugin coreActivity: Activity Logging SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

CVE-2025-1843

A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall/dao/ProductMapper.java. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploi...

CVE-2025-22765

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This issue affects WP Order By: from n/a through = 1.4.2...

Prolink DL-7203E 安全漏洞

The Prolink DL-7203E is a wireless router from Prolink USA. A security vulnerability exists in the Prolink DL-7203E version V4.0.0B05, which stems from a susceptibility to SQL injection attacks and allows an attacker to manipulate SQL queries by injecting malicious SQL code into the orderby...

WordPress GamiPress plugin <= 7.2.1 - Unauthenticated SQL Injection via orderby Parameter vulnerability

Unauthenticated SQL Injection via orderby Parameter vulnerability discovered by abrahack in WordPress Plugin GamiPress versions = 7.2.1...

CVE-2025-22765

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This issue affects WP Order By: from n/a through = 1.4.2...

PT-2025-4685 · WordPress · Wp Order By

Name of the Vulnerable Software and Affected Versions: WP Order By versions 1.4.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This means an attacker can inject malicious scripts...

WordPress plugin WP Order By 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress WP Order By Plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin WP Order By versions = 1.4.2...

GHSA-6Q3Q-6V5J-H6VG Querydsl vulnerable to HQL injection through orderBy

Summary The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repositoryhttps://github.com/querydsl/querydsl whe...

SurrealDB has an Uncaught Exception Sorting Tables by Random Order

Sorting table records using an ORDER BY clause with the rand function as sorting mechanism could cause a panic due to relying on a comparison function that did not implement total order. This event resulted in a panic due to a recent change in Rust 1.81. Impact A client that is authorized to run...

GHSA-M52V-24P8-654F SurrealDB has an Uncaught Exception Sorting Tables by Random Order

Sorting table records using an ORDER BY clause with the rand function as sorting mechanism could cause a panic due to relying on a comparison function that did not implement total order. This event resulted in a panic due to a recent change in Rust 1.81. Impact A client that is authorized to run...

PT-2024-40361 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.1.0 Description: The issue arises when using an ORDER BY clause with the rand function for sorting table records, which can cause a panic due to a comparison function that does not implement total order. This can...

GHSA-WPVF-5MC3-HV6M Duplicate Advisory: Querydsl SQL/HQL injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references. Original Description Querydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery...

PT-2024-33345

Name of the Vulnerable Software and Affected Versions Querydsl version 5.1.0 OpenFeign Querydsl version 6.8 Description The issue allows SQL/HQL injection in the orderBy clause of JPAQuery. This is possible when untrusted input is directly used in query construction. Note that the Querydsl...