484 matches found
CVE-2024-8484
CVE-2024-8484 REST API TO MiniProgram = 4.7.1 - 인증되지 않은 SQL 인젝션 CVE: CVE-2024-8484 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Score: 7.5 Slugs: rest-api-to-miniprogram 설명: WordPress용 REST API TO MiniProgram 플러그인은 4.7.1을 포함한 모든 버전에서 /wp-json/watch-life-net/v1/comment/getcomments REST...
EUVD-2026-92704
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...
CVE-2026-88424
FineAdmin v1.0 is susceptible to a SQL injection vulnerability within the ButtonService.GetListByFilter() function. The flaw exists in the field/order parameter , which allows an attacker to execute crafted SQL statements to access sensitive database information. No specific exploit information o...
MISP < 2.5.37 - SQL Injection
MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation. id: CVE-2026-44381 info: name: MISP 2.5.37 - SQL Injection author: malcha severity: medium description: | MISP befo...
CVE-2022-0439
CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ 블라인드 SQL 인젝션 필수 사항 sqlmap이 설치되어 있어야 하며, subscriber+ 권한을 가진 유효한 사용자 이름과 비밀번호가 필요합니다. 사용법 usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w URL, --url URL...
CVE-2022-32132
osTicket 지원 티켓팅 시스템용 CVE-2022-32132 반사형 XSS: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...
CVE-2019-17671
＃CVE-2019-17671 ＃url + /？static = 1＆order = asc...
CVE-2024-33911
The School Management 10.3.4 - 인증 후 SQL 인젝션 익스플로잇 제목: The School Management 10.3.4 - Post-Authenticated SQL Injection 날짜: 2024년 4월 29일 익스플로잇 작성자: Ivan Spiridonov xbz0n 공급업체 홈페이지: https://theschool-management.com 버전: 10.3.4 테스트 환경: Ubuntu 22.04 CVE: CVE-2024-33911 취약점 The School Management 플러그인, 버...
CVE-2024-8275
CVE-2024-8275 CVE-2024-8275는 WordPress 플러그인 The Events Calendar에서 발견된 심각한 SQL 인젝션 취약점입니다. 이 취약점은 버전 6.6.4 이하에 영향을 미칩니다. 문제는 tribehasnextevent 함수의 'order' 매개변수에 대한 이스케이핑이 불충분하여 발생합니다. 입력 값이 적절히 검증되지 않았기 때문에 인증되지 않은 공격자가 악의적인 SQL 쿼리를 추가하여 데이터베이스에 저장된 민감한 정보에 접근할 수 있습니다. 1- Python 설치: Python 3이 설치되어...
CVE-2026-13200
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
EUVD-2026-83551
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-13200: Improper Neutralization of Special Elements used in an SQL Command
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
PT-2026-95776
Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied inp...
PT-2026-84102
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
CVE-2026-18884 WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
EUVD-2026-66333
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
WordPress The School Management plugin <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter vulnerability
Authenticated Custom+ SQL Injection via 'order0dir' Parameter vulnerability discovered by j4ck13ch4n in WordPress Plugin The School Management – Education & Learning Management versions = 5.4...