1472 matches found
CVE-2023-45018 Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the includes/login.php resource does not validate the characters received and they are sent unfiltered to the database...
WordPress Cyr to Lat enhanced Plugin < 3.7 SQLi Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cyrtolatproject:cyrtolat"; ifdescription...
CVE-2023-4691 Bookly < 22.4 - Admin+ SQLi
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2023-23651
The CVE-2023-23651 entry concerns the WordPress plugin MainWP Google Analytics Extension (
Dawa Pharma 1.0-2022 SQL Injection
Title: dawa-pharma-1.0-2022 Multiple-SQLi Author: nu11secur1ty Date: 10/12/2023 Vendor: https://www.mayurik.com/ Software: https://www.mayurik.com/source-code/P0349/best-pharmacy-billing-software-free-download Reference: https://portswigger.net/web-security/sql-injection Description: The email...
WordPress WP Popup Banners Plugin <= 1.2.5 Multiple SQLi Vulnerabilities
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:accesspressthemes:wppopupbanners"; if description...
CVE-2023-4103
QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application...
CVE-2023-4103
CVE-2023-4103 describes a remote SQL injection in IDM Sistemas QSige caused by improper input parameter filtering in the web application. This leads to potential SQL injections, information disclosure, and Denial of Service, with all three CIA impacts rated High. A prerequisite for exploitation i...
CVE-2023-4103 Multiple vulnerabilities in IDM Sistemas QSige
QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application...
CVE-2023-43739 Online Book Store Project v1.0 - Unauthenticated SQL Injection (SQLi)
The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-5004
The CVE-2023-5004 entry concerns the Hospital management system (version 378c157). The vulnerability is a SQL injection in the authentication flow that allows bypassing login, enabling unauthorized access. Multiple connected sources corroborate that the issue stems from SQLI in the authentication...
SQL Injection in `icms2/install/index.php`
Introduction I'm quite hesitant about reporting this vulnerability. After thinking about it, I knew I needed to provide this information to you!. As described in the documentation https://docs.instantcms.ru/en/manual/instal, at Post-Installation steps, you described that the installation director...
CVE-2023-4670 SQLi in Innosa's Probbys
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Innosa Probbys allows SQL Injection. This issue affects Probbys: before 2...
CVE-2023-4766 SQLi in Movus Admin Panel
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Movus allows SQL Injection. This issue affects Movus: before 20230913...
WooCommerce Beta Tester < 2.2.4 - Admin+ SQLi
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2023-3616 SQLi in Mava Softwares Hotel Management System
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Mava Software Hotel Management System allows SQL Injection. This issue affects Hotel Management System: before 2.0...
WP Job Portal < 2.0.6 - Unauthenticated SQLi
Description The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users Setup as admin: Create a dummy company and a job if there are none Attack as unauthenticated: time curl -X POST --data...
CVE-2023-0579 YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLi
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks...
CVE-2023-37069: Improper Neutralization of Special Elements used in an SQL Command
Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection SQLI attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the login id and password fields during the login...
