CVE-2023-5041

The CVE-2023-5041 entry concerns the Track The Click WordPress plugin (versions before 0.3.12). Root cause: improper sanitization of query parameters to the stats REST endpoint, enabling a time-based blind SQL injection in database queries when accessed by an authenticated user with author role o...

CVE-2023-5041: Improper Neutralization of Special Elements used in an SQL Command

The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database...

CVE-2023-6373

CVE-2023-6373 affects the ArtPlacer Widget WordPress plugin prior to 2.20.7. The flaw is an SQL injection caused by unsanitized/unescaped id parameter used in a query, exploitable by editors (and above); CSRF absence can permit exploitation against a logged-in editor. In practice, this yields a h...

Logsensor - A Powerful Sensor Tool To Discover Login Panels, And POST Form SQLi Scanning

A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning Features login panel Scanning for multiple hosts Proxy compatibility http, https Login panel scanning are done in multiprocessing so the script is super fast at scanning many urls quick tutorial & screenshots are shown a...

Sql injection

A vulnerability was found in Weitong Mall 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file platform-shop\src\main\resources\com\platform\dao\OrderDao.xml. The manipulation of the argument sidx/order leads to sql injection. The...

CVE-2023-49633 Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyeraddress' parameter of the buyerdetailsubmit.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-4541 SQLi in Weens Admin Panel

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2023-51448

CVE-2023-51448 affects Cacti 1.2.25, where a Blind SQL Injection flaw exists in SNMP Notification Receivers within managers.php. An authenticated user with Settings/Utilities can craft a GET request to /cacti/managers.php carrying an SQLi payload in selected_graphs_array, enabling potentially una...

CVE-2023-49688 Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-45119 Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi)

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'n' parameter of the /update.php?q=quiz resource does not validate the characters received and they are sent unfiltered to the database...

WordPress Advanced Database Cleaner Plugin < 3.1.3 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sigmaplugin:advanceddatabasecleaner"; if description...

CVE-2023-49707

SQLi vulnerability in S5 Register module for Joomla...

CVE-2023-40629

SQLi vulnerability in LMS Lite component for Joomla...

CVE-2023-49708 Extension - joomstar.com - SQLi vulnerability in Starshop component for Joomla 1.0.0-1.0.9

SQLi vulnerability in Starshop component for Joomla...

CVE-2023-49708

CVE-2023-49708 is a SQL injection vulnerability in the Starshop component for Joomla. The affected entry indicates a network-exposed vulnerability with no privileges required and no user interaction, yielding a CVSS v3.1 base score of 9.8 (Confidentiality/Integrity/Availability impact: HIGH). The...

CVE-2023-49707

CVE-2023-49707 is an SQL injection in the S5 Register Joomla extension. Affected versions: 1.0.0–3.0.0. Root cause is a SQLi in the S5 Register module, with CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8, critical). Exploitation details are not provided in the documents. No remedia...

CVE-2023-40629: Improper Neutralization of Special Elements used in an SQL Command

SQLi vulnerability in LMS Lite component for Joomla...

CVE-2023-49707: Improper Neutralization of Special Elements used in an SQL Command

SQLi vulnerability in S5 Register module for Joomla...

WordPress Brute Force Protection < 2.2.6 - Admin+ SQLi

Description The plugin does not properly sanitise and escape the orderby parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2023-5634 SQLi in ArslanSoft's Education Portal

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ArslanSoft Education Portal allows SQL Injection. This issue affects Education Portal: before v1.1...