Purchase Order Management v1.0 - SQL Injection

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/viewdetails.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is...

LearnPress < 4.3.2 - Broken Access Control

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders...

MajorDoMo - Unauthenticated RCE

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. id: CVE-2026-27174 info: name: MajorDoMo - Unauthenticated RCE author:...

Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload

Amasty Order Attributes for Magento 2 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting. id:...

PT-2026-104126

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-104115

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

PT-2026-104113

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the...

CVE-2026-25513

CVE-2026-25513: FacturaScripts の API ORDER BY 句における SQL インジェクション 概要 項目| 詳細 ---|--- CVE ID| CVE-2026-25513 深刻度| 高 アドバイザリ| アドバイザリを表示 発見者| Lukasz Rybak 影響を受ける製品 facturascripts/facturascripts （バージョン: orderBy = $field . ' ' . $order; return $this; このチェックは SQL 関数を許可することを意...

CVE-2026-78070

plgcontentdpcalendar 中的 ORDER BY 短代码 SQL 注入 DPCalendar Free ≤ 10.11.2 — 作者级用户通过基于时间的盲注提取完整数据库 摘要 plgcontentdpcalendar 内容插件会解析嵌入在 Joomla 文章正文中的 events order="..."/events 短代码。order 参数值被直接传递给 EventsModel::setState'list.ordering', ...，完全绕过了模型自身的 populateState 白名单。该值随后被插入到 SQL ORDER BY 子句中，仅受...

CVE-2026-1581-Analysis-Lab

CVE-2026-1581 — wpForo Forum（GET'wpfob' → wpforosanitizeorderby..., context, default 行为证明： wpfob=modified,SELECT SLEEP5 在存在漏洞的版本上造成约 5 秒延迟；已修复版本响应接近基线。 我从 CVE 公告中观察到的内容 CVE 公告仅说明这是通过 wpfob 参数进行的基于时间的 SQL 注入，已在 2.4.15 中修复。在分析时，尚无公开可用的 PoC。 因此，本文通过 2.4.14 与 2.4.15 之间的源代码差异比对 构建，追踪参数从 HTTP 输入经过清理到用于...

CVE-2025-58789

Sink: getOrderParameters 函数中的 $orderBy 和 $order 变量会导致 SQL 注入漏洞。 PoC...

CVE-2026-27470

⚠️ YASAL UYARI / LEGAL DISCLAIMER Bu araç yalnızca eğitim amaçlı ve yazılı izin alınmış güvenlik testleri için geliştirilmiştir. Sahip olmadığınız veya test etmek için açık yazılı izniniz olmayan sistemlere karşı kullanılması yasadışıdır. Yetkisiz erişim, birçok ülkede ağır cezai yaptırımlara...

CVE-2026-27470-POC

CVE-2026-27470 — ZoneMinder 二阶 SQL 注入 PoC 作者：d3vn0mi | CVSS 8.8 | 需认证 | 需要 Events 权限 概述 CVE-2026-27470 是 ZoneMinder web/ajax/status.php 中的一个二阶 SQL 注入漏洞——具体位于 getNearEvents 函数中。 详情| 值 ---|--- 受影响版本| ZoneMinder = 1.36.37 及 1.37.61 – 1.38.0 修复版本| 1.36.38 / 1.38.1 类型| 二阶 SQL 注入 是否需要认证| 是（任何拥有 Events...

CVE-2026-65761

CVE-2026-65761 — EasyStore Joomla 認証前SQLインジェクション filtersortby 方向 → ORDER BY インジェクション → 全DB読み取り 概要 CVE-2026-65761 （CVSS 9.3 Critical）は、JoomShaper製 EasyStore for Joomla における 未認証SQLインジェクション であり、バージョン ≤ 2.0.1 に影響します。 製品一覧パラメータ filtersortby は、列と方向に分割されます。列は許可リストに対して検証されますが、方向は ASC/DESC の制限なしに SQL のORD...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution のアクセス制御の不備 WordPress プラグイン Eventin アクティブインストール数 10,000+ における、認証なしの PII 個人情報 開示 と 注文データの偽造 です。公開 REST エンドポイントが任意の訪問者に wprest nonce を配布し、後続の 3 つのパーミッションコールバックがその nonce を認証の代用として受け入れるため、すべての顧客注文エンドポイントで認可が崩壊します。 完全な技術解説:...

CVE-2024-33911

The School Management 10.3.4 - Post-Authenticated SQL Injection Exploit Title: The School Management 10.3.4 - Post-Authenticated SQL Injection Date: 29 April, 2024 Exploit Author: Ivan Spiridonov xbz0n Vendor Homepage: https://theschool-management.com Version: 10.3.4 Tested on: Ubuntu 22.04 CVE:...

CVE-2026-103353

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14...

EUVD-2026-90761

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14...

CVE-2026-96173

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...