Sql injection

The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users...

CVE-2022-0788: Improper Neutralization of Special Elements used in an SQL Command

The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users...

PT-2022-13441 · WordPress · Wp Fundraising Donation/Crowdfunding Platform

Name of the Vulnerable Software and Affected Versions: WP Fundraising Donation and Crowdfunding Platform WordPress plugin versions prior to 1.5.0 Description: The issue is related to an SQL injection that can be exploited by unauthenticated users due to a parameter not being properly sanitized an...

WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi

The plugin does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users PoC curl 'https://example.com/index.php?restroute=/xs-donate-form/payment-redirect/3' \ --data '"id": "SELECT 1 FROM...

CVE-2022-0948

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection...

CVE-2022-0948

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection...

CVE-2022-0948

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection...

Sql injection

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection...

CVE-2022-0948: Improper Neutralization of Special Elements used in an SQL Command

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection...

PT-2022-13548

Name of the Vulnerable Software and Affected Versions The Order Listener for WooCommerce WordPress plugin versions prior to 3.2.2 Description The issue arises from the lack of sanitization and escaping of the id parameter in a SQL statement via a REST route. This REST route is accessible to...

Wordpress Plugin Paid Memberships Pro SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in Wordpress Plugin Paid Memberships Pro versions prior to 2.6....

CVE-2022-0411

The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the postid parameter before using it in a SQL statement via a REST route of the plugin accessible to any authenticated user, leading to a SQL injection...

Sql injection

The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the postid parameter before using it in a SQL statement via a REST route of the plugin accessible to any authenticated user, leading to a SQL injection...

PT-2022-13163

Name of the Vulnerable Software and Affected Versions Asgaros Forum WordPress plugin versions prior to 2.0.0 Description The issue concerns a SQL injection problem. It occurs because the post id parameter is not properly sanitised and escaped before being used in a SQL statement via a REST route ...

CVE-2022-0411: Improper Neutralization of Special Elements used in an SQL Command

The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the postid parameter before using it in a SQL statement via a REST route of the plugin accessible to any authenticated user, leading to a SQL injection...

CVE-2021-25114

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discountcode in one of its REST route available to unauthenticated users before using it in a SQL statement, leading to a SQL injection...

CVE-2021-25114: Improper Neutralization of Special Elements used in an SQL Command

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discountcode in one of its REST route available to unauthenticated users before using it in a SQL statement, leading to a SQL injection...

PT-2022-9669

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro WordPress plugin versions prior to 2.6.7 Description The issue concerns a SQL injection problem. It occurs because the discount code is not properly escaped before being used in a SQL statement, specifically in one of the...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in Wordpress Plugin Paid Memberships Pro versions prior to 2.6....

NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection

The plugin does not sanitise and escape the nxid parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection time wget 'https://example.com/?restroute=/notificationx/v1/analytics' --post-data="nxid=sleep2 -- x" -q -O-...