CVE-2025-21628 Chatwoot has a Blind SQL-injection in Conversation and Contacts filters

Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of queryoperator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by addi...

CVE-2024-54762

Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword method does not completely filter SQL injection keywords, resulting in the risk of SQL injection...

Attackers exploiting a patched FortiClient EMS vulnerability in the wild

Introduction During a recent incident response, Kaspersky's GERT team identified a set of TTPs and indicators linked to an attacker that infiltrated a company's networks by targeting a Fortinet vulnerability for which a patch was already available. This vulnerability is an improper filtering of S...

CVE-2024-52335

A vulnerability has been identified in syngo.plaza VB30E All versions VB30EHF05. The affected application do not properly sanitize input data before sending it to the SQL server. This could allow an attacker with access to the application could use this vulnerability to execute malicious SQL...

CVE-2024-52335

CVE-2024-52335 affects syngo.plaza VB30E (all versions before VB30E_HF05). The issue is failure to sanitize input data before sending to the SQL server, enabling arbitrary SQL commands that could compromise the entire database. Affected software: syngo.plaza VB30E; root cause: unsanitized SQL que...

PT-2024-33345

Name of the Vulnerable Software and Affected Versions Querydsl version 5.1.0 OpenFeign Querydsl version 6.8 Description The issue allows SQL/HQL injection in the orderBy clause of JPAQuery. This is possible when untrusted input is directly used in query construction. Note that the Querydsl...

PT-2024-26561 · Unknown · Opensis Community Edition

Name of the Vulnerable Software and Affected Versions: OpenSis Community Edition versions 8.0 through 9.1 Description: The issue is related to SQL injection due to a lack of sanitization. An authenticated user can perform SQL injection because the application directly appends an arbitrary value...

PT-2024-14507 · Unknown · Streampark-Console

Name of the Vulnerable Software and Affected Versions: streampark-console versions prior to 2.1.4 Description: The issue arises from the lack of validation of the sort field sent from the front-end to the back-end, which is used to generate SQL queries. This poses a risk of SQL injection,...

PT-2024-26266

Name of the Vulnerable Software and Affected Versions Country State City Dropdown CF7 plugin for WordPress versions up to and including 2.7.2 Description The Country State City Dropdown CF7 plugin for WordPress is susceptible to SQL Injection through the cnt and sid parameters. Insufficient input...

CVE-2024-4352

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'getcalendarmaterials' function. The plugin is also vulnerable to SQL Injection via the ‘year’ parameter of that function due to...

PT-2024-11920 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP WordPress plugin versions prior to 2.24.1 Description: The issue concerns the improper escaping of user input before it reaches SQL queries, potentially allowing unauthenticated attackers to perform SQL Injection attacks...

PT-2023-26326 · Unknown · Superwebmailer

Name of the Vulnerable Software and Affected Versions: SuperWebMailer version 9.00.0.01710 Description: The issue allows for Export SQL Injection via the size parameter. This enables potential attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification...

The vulnerability of the ajax_hosts() and ajax_hosts_noany() functions (graphs.php) of the Cacti network monitoring tool allows a hacker to execute arbitrary SQL queries.

The vulnerability of the ajaxhosts and ajaxhostsnoany functions graphs.php of the Cacti network monitoring tool is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries using a specially...

CVE-2021-36393

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses...

PT-2023-16123 · WordPress · Wp Yelp Review Slider

Name of the Vulnerable Software and Affected Versions: WP Yelp Review Slider WordPress plugin versions prior to 7.1 Description: The issue is related to a SQL injection that occurs due to improper sanitization and escaping of a parameter before it is used in a SQL statement. This can be exploited...

PT-2023-14599 · Unknown · Smartpower Web

Name of the Vulnerable Software and Affected Versions: Smartpower Web versions prior to 23.01.01 Description: The issue is related to an Improper Input Validation vulnerability that allows SQL Injection in Smartpower Web. This vulnerability can be exploited due to the lack of proper validation of...

PT-2022-26534 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to perform CRUD operations on the application databases due to incorrect validation of the entriesPerPage parameter against SQL injection attacks. Recommendations: For...

PT-2022-21649 · WordPress · Cleantalk

Name of the Vulnerable Software and Affected Versions: Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin versions prior to 5.185.1 Description: The issue concerns a lack of validation for ids used in SQL statements, potentially leading to SQL injection. This could be exploited by...

PT-2022-26314 · Unknown · Open Source Sacco Management System

Name of the Vulnerable Software and Affected Versions: Open Source SACCO Management System version 1.0 Description: The issue concerns SQL Injection via the "/sacco shield/manage loan.php" API endpoint. This allows for potential unauthorized access and manipulation of data. No information is...

PT-2022-21317 · WordPress · Import All Xml

Name of the Vulnerable Software and Affected Versions: Import all XML, CSV & TXT WordPress plugin versions prior to 6.5.8 Description: The issue is related to the improper sanitization and escaping of imported data, which is then used in SQL statements. This leads to SQL injection, a type of atta...