632 matches found
PT-2025-15412 · WordPress · Coreactivity
Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging plugin for WordPress versions prior to 2.8 Description: The issue arises from insufficient escaping of user-supplied parameters order and orderby, and a lack of proper preparation of existing SQL queries. This...
FastCMS 安全漏洞
FastCMS is a content management system from FastCMS Inc. A security vulnerability exists in FastCMS 0.1.5 and earlier versions, which stems from improper manipulation of the orderBy parameter in the /api/client/article/list file, which could lead to a SQL injection attack...
WordPress plugin WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins SQL注入漏洞
WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin WordPress Report Brute Force Attacks and Login Protection...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
WordPress plugin Multilevel Referral Affiliate Plugin for WooCommerce SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
PT-2025-9017
Name of the Vulnerable Software and Affected Versions GFast versions v2 through v3.2 Description A SQL injection issue was found via the OrderBy parameter at the "/system/operLog/list" API endpoint. Recommendations For GFast versions v2 through v3.2, avoid using the OrderBy parameter in the...
CVE-2024-55160
The backend management system GFast (developed by tiger1103) is vulnerable to SQL injection in versions v2 through v3.2 . The flaw exists within the OrderBy parameter at the /system/operLog/list API endpoint. This vulnerability could allow an attacker to execute unauthorized SQL commands. As a wo...
GFast 安全漏洞
GFast is a GF Go Frame based backend management system by tiger1103. A security vulnerability exists in GFast v2 to v3.2, which originates from a SQL injection in the OrderBy parameter of /system/operLog/list...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
CVE-2024-13500
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied...
CVE-2024-13500 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied...
CVE-2024-13500 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied...
WordPress plugin WP Project Manager SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...
WordPress WP Project Manager plugin <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter vulnerability
Authenticated Subscriber+ SQL Injection via orderby Parameter vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Project Manager versions = 2.6.17...
CVE-2024-4743
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlmsfavorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...