WordPress Mail Mint SQL Injection Vulnerability

WordPress Mail Mint 1.31.4 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper handling of the filters parameter in the /wp-json/mrm/v1/segments/contacts REST endpoint. The value of the filter parameter provided by users is insufficiently escaped. In li...

WebVella ERP SQL Injection Vulnerability

WebVella ERP versions 1.8.8 and earlier have a SQL injection vulnerability. This vulnerability stems from the fact that the literal expressions in the WHERE clause of the EQL query API are not cleaned properly. Attackers can exploit this vulnerability by sending specially crafted single-quote...

The cosy icecms SQL injection vulnerability

The thecosy icecms versions 4.1.5 and earlier have a SQL injection vulnerability. This vulnerability stems from unvalidated SQL injections. Attackers can append additional SQL statements after the LIMIT clause in the QueryWrapper.last method by providing specially crafted inputs to the num...

Tatsh bincookie SQL injection vulnerability

Versions of Tatsh Bincookie prior to 7.6.3 have a SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, which may lead to blind SQL injections...

YuePeng has a SQL injection vulnerability

YuePeng ERUPT: Versions 2.3.0 and earlier have a SQL injection vulnerability. This vulnerability arises from failing to escape the linkTreeVal parameter in the POST request for /erupt-api/data/table/erupt, allowing HQL injection. This may enable authenticated users to bypass the tree scope data...

WordPress Backuply has a SQL injection vulnerability

WordPress Backuply 1.5.8 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of user-provided parameters in the Biographical Info field, as well as inadequate preparation of existing SQL queries. Attackers can trigger second-stage SQL...

WordPress MapSVG SQL Injection Vulnerability

WordPress MapSVG versions 8.16.1 and earlier have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which may lead to SQL injections...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.6.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper cleaning of user input for the parameters srcby.val.start / srcby.val.end operator 'bt', and insufficient preparation of existing SQL queries. This leads to blind SQL injections...

Frappe HR SQL Injection Vulnerability

Versions of Frappe before 14.38.2, as well as versions before 14.x before 15.64.0, 15.x before 16.18.0, and 16.x before 16.18.0 have a SQL injection vulnerability. This vulnerability stems from the lack of input validation on certain endpoints, which may lead to SQL injections. Any authenticated...

Frappe HR SQL Injection Vulnerability

Versions of Frappe HR prior to 15.60.3 and from 16.0.0 to 16.7.1 have a SQL injection vulnerability. This vulnerability arises from the use of insecure SQL string interpolation in the Salary Payments via ECS report, which allows authenticated HR users to inject SQL statements through report filte...

The cosy icecms SQL injection vulnerability

The thecosy icecms 4.1.5 and earlier versions have a SQL injection vulnerability. This vulnerability arises from the lack of validation for the num path parameter in the /WebArticle/findarticlesbynum route. This makes the system vulnerable to SQL injection attacks. A remote attacker can append...

WHEELS.DEV: Wheels SQL injection vulnerability

WHEELS.DEV: Versions of Wheels 4.1.2 and earlier have an SQL injection vulnerability. This vulnerability occurs in MySQL/MariaDB environments where escape characters are enabled. When the application provides request data to inline literal paths, it does not consider escape characters and simply...

WordPress Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance plugin <= 1.31.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.4...

Astra Linux – vulnerability in sogo

In SOGo versions prior to 5.12.7, when PostgreSQL or MariaDB is used and cleartext passwords are stored, SQL injection is possible. This issue is related to cpassword = '%@' in changePasswordForLogin...

Astra Linux – vulnerability in PostgreSQL 11

In the extension script, a SQL injection vulnerability was found in PostgreSQL when it uses @extowner@, @extschema@, or @extschema:...@ within a quoting construct dollar quoting, '', or "". If an administrator has installed files from a vulnerable, trusted, non-bundled extension, an attacker with...

Astra Linux – Vulnerability in Zabbix

A low-privilege regular Zabbix user with API access can exploit the SQL injection vulnerability in the include/classes/api/CApiService.php file to execute arbitrary SQL commands using the groupBy parameter...

Astra Linux – Vulnerability in Apache Log4j1.2

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter, where the values to be inserted are converted using PatternLayout. The message converter %m is likely to always be included. This allows attackers to manipulate SQL statements by entering crafted...

Astra Linux – vulnerability in libhibernate3-java

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. An SQL injection in the implementation of the JPA Criteria API can allow un sanitized literals to be used when a literal appears in the SQL comments of a query. This flaw may enable an attacker to access...

Astra Linux – Vulnerability in OpenLDAP

In OpenLDAP 2.x versions before 2.5.12 and 2.6.x versions before 2.6.2, there is a SQL injection vulnerability in the experimental slapd backend, caused by a SQL statement within an LDAP query. This vulnerability can occur during an LDAP search operation, when the search filter is processed, due ...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...