CVE-2025-6184: Improper Neutralization of Special Elements used in an SQL Command

The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the getsubmittedassignments function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter an...

PT-2025-32967 · WordPress · Tutor Lms Pro

Name of the Vulnerable Software and Affected Versions: Tutor LMS Pro versions prior to 3.7.1 Description: The Tutor LMS Pro plugin for WordPress is susceptible to a time-based SQL Injection issue. This occurs due to insufficient input validation and query preparation when handling the order...

Inventory Management System editPayment.php File SQL Injection Vulnerability

Inventory Management System is an inventory management system. Inventory Management System has a SQL injection vulnerability that stems from insufficient filtering of the orderId parameter in the file /phpaction/editPayment.php. No details of the vulnerability are available at this time...

CVE-2022-48329

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...

CVE-2021-24728

The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages...

CVE-2021-24754

The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue...

CVE-2021-24877

The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed...

CVE-2021-24860

The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue...

CVE-2020-35700

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...

CVE-2019-14968

An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action...

PT-2025-20576

Name of the Vulnerable Software and Affected Versions SourceCodester Client Database Management System version 1.0 Description The software is susceptible to a SQL Injection issue in the 'user order customer update.php' file. The issue occurs through the order id POST parameter. Exploitation of...

PT-2025-15412 · WordPress · Coreactivity

Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging plugin for WordPress versions prior to 2.8 Description: The issue arises from insufficient escaping of user-supplied parameters order and orderby, and a lack of proper preparation of existing SQL queries. This...

crud-query-parser SQL注入漏洞

crud-query-parser is a tool by Guilherme Chaguri Personal Developer. A SQL injection vulnerability exists in crud-query-parser that stems from not properly neutralizing the order/sort parameter, resulting in SQL injection...

CVE-2025-1321: Improper Neutralization of Special Elements used in an SQL Command

The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including, 9.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2024-57098

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter...

PT-2025-3401

Name of the Vulnerable Software and Affected Versions Moss version v0.1.3 Description The issue is related to an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter. This vulnerability can be exploited by injecting malicious input into...

CVE-2024-57098: Improper Neutralization of Special Elements used in an SQL Command

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter...

CVE-2024-57098

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter...

Moss 安全漏洞

Moss is a simple and lightweight content management system open-sourced by deep-project. A security vulnerability exists in Moss v0.1.3, which stems from the presence of an SQL injection that allows an attacker to inject a crafted payload into the order parameter...

CVE-2024-13457

The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view ord...