WordPress Ketchup Restaurant Reservations plugin <= 1.0.0 - Unauthenticated Blind SQL Injection (SQLi) vulnerability

Unauthenticated Blind SQL Injection SQLi vulnerability discovered by Bastijn Ouwendijk in WordPress Ketchup Restaurant Reservations plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of August 29, 2022 and is not available for download. This closure is...

CVE-2022-36201

Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php...

CVE-2022-36201

Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php...

CVE-2022-36201

CVE-2022-36201 affects Doctor’s Appointment System v1.0. A blind SQL injection vulnerability exists in settings.php and is also exploitable via the id parameter in booking.php, enabling attackers to potentially access or modify data. The issue is documented with a high severity (CVSS v3.1: 9.8, c...

CVE-2022-36201: Improper Neutralization of Special Elements used in an SQL Command

Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php...

Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi

The plugin does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...

CVE-2022-36394

CVE-2022-36394 affects WordPress Contest Gallery plugin versions ≤ 17.0.4. The vulnerability is an authenticated SQL Injection (author+) caused by unsanitised/escaped inputs in SQL statements, exploitable by users with author+ privileges. The impact, as described in the sources, includes a high-s...

BadgeOS < 3.7.1.3 - Subscriber+ SQLi

The plugin does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections PoC Open the following URL as any authenticated user such as subscriber:...

Multi-Language Hotel Management 2022 1.0 SQL Injection Vulnerability

Title: Multi-Language-Hotel-Management-2022 1.0 SQLi Author: nu11secur1ty Vendor: https://www.nikhilbhalerao.com/ Software: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/Nikhil%20Bhalerao/2022/Multi-Language-Hotel-Management-2022/Docs/sparkz.zip Reference:...

Multi-Language Hotel Management 2022 1.0 SQL Injection

Title: Multi-Language-Hotel-Management-2022 1.0 SQLi Author: nu11secur1ty Date: 08.03.2022 Vendor: https://www.nikhilbhalerao.com/ Software: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/Nikhil%20Bhalerao/2022/Multi-Language-Hotel-Management-2022/Docs/sparkz.zip Reference:...

NEX-Forms < 7.9.7 - Authenticated SQLi

The plugin does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin setting...

WordPress Blog2Social Plugin <= 5.5.0 SQLi Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2022-31879

CVE-2022-31879 affects Online Fire Reporting System v1.0, with a confirmed SQL injection via the date parameter. Affects the application logic where user input is used in SQL queries, enabling potentially arbitrary queries and unauthorized data access or manipulation as described in multiple sour...

SonicWall Issues Patch for Critical Bug Affecting its Analytics and GMS Products

Network security company SonicWall on Friday rolled out fixes to mitigate a critical SQL injection SQLi vulnerability affecting its Analytics On-Prem and Global Management System GMS products. The vulnerability, tracked as CVE-2022-22280, is rated 9.4 for severity on the CVSS scoring system and...

CVE-2022-33960: Improper Neutralization of Special Elements used in an SQL Command

Multiple Authenticated subscriber or higher user role SQL Injection SQLi vulnerabilities in Social Share Buttons by Supsystic plugin = 2.2.3 at WordPress...

CVE-2017-20138: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 AND 'Ggks'='Ggks leads to sql injection Blind. It is possible to initiate the...

WordPress Youzify plugin <= 1.1.9 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Youzify plugin versions = 1.1.9. Solution Update the WordPress Youzify plugin to the latest available version at least 1.2.0...

WordPress Visual Slide Box Builder 3.2.9 SQL Injection Vulnerability

Title: WordPress 6.0 - Visual Slide Box Builder 3.2.9 SQLi Author: nu11secur1ty Vendor: https://wphive.com/ Software: https://wphive.com/plugins/wp-visual-slidebox-builder/?pluginversion=3.2.9 Reference:...

WordPress WP Statistics Plugin <= 12.6.6 SQLi Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Django < 3.2.14, 4.x < 4.0.6 SQLi Vulnerability - Windows

Django is prone to an SQL injection SQLi vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...