CVE-2021-45946

Wasm3 0.5.0 has an out-of-bounds write in CompileBlock called from CompileLoopOrBlock and CompileBlockStatements...

WordPress WooCommerce Gutenberg Blocks Plugin SQL Injection (CVE-2021-32789)

An SQL injection vulnerability exists in WordPress WooCommerce Gutenberg Blocks Plugin. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL statements on the affected system...

WordPress Ni WooCommerce Custom Order Status plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in the WordPress Ni WooCommerce Custom Order Status plugin, which stems fro...

Sql injection

The wcfmajaxcontroller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections...

taocms SQL Injection Vulnerability (CNVD-2021-101663)

Taocms is a micro Cms Content Management System in China.Taocms has a SQL injection vulnerability in version 3.0.2, which stems from the application's lack of validation of externally entered SQL statements. An attacker could use this vulnerability to execute illegal SQL commands to steal sensiti...

CVE-2021-43410 airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 1 of airavata-django-portal 1...

SQL Injection

francoisjacquet/rosariosis is vulnerable to SQL Injection vulnerability. The vulnerability exists because the condition in sessionstart function of Warehouse.php is not properly validated which allows a remote attacker to execute PostgreSQL statements...

CVE-2021-44427

An unauthenticated SQL Injection vulnerability in Rosario Student Information System aka rosariosis before 8.1.1 allows remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter...

Advantech R-SeeNet application multiple SQL injection vulnerabilities in the 'group_list' page

Summary Multiple exploitable SQL injection vulnerabilities exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as...

Talariax SendQuick Alertplus Server Admin Information Disclosure Vulnerability

TalariaX Pte Ltd Talariax SendQuick Alertplus Server Admin is a server management system of TalariaX Pte Ltd, Singapore. versions prior to 4.3 8HF11, a security vulnerability exists in the software where /appliance/shiftmgn.php lacks effective filtering and escaping of user submitted SQL...

WordPress Plugin SQL Injection Vulnerability (CNVD-2021-101472)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the server in PHP and MySQL to set up a personal blog site. WordPress Plugin is a WordPress open source application plug-ins. wordpress Plugin Header Footer Code Manager in the...

libsepol: heap-based buffer overflow in ebitmap_match_any()

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmapmatchany called indirectly from cilcheckneverallow. This occurs because there is sometimes a lack of checks for invalid statements in an optional block...

sqlite: mishandling of certain SELECT statements with non-existent VIEW can lead to DoS

SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash...

sqlite security update

An update is available for sqlite. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list SQLite is a C library that implements an SQL database engine. A large subset o...

RLSA-2021:4396 Moderate: sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...

Moderate: sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...

LearnPress < 4.1.4 - Admin+ SQL Injection

The plugin does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues PoC Id needs to start with a valid course/lesson/quiz/question ID:...

Sql injection

The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to...

MariaDB 10.4.0 < 10.4.22 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.4.22. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.4.22 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.35 and...

YouPHPTube catName parameter SQL injection vulnerability

YouPHPTube is a PHP-based video website system. youPHPTube is vulnerable to SQL injection in version 10.0 and earlier, which stems from the lack of validation of external input SQL statements for the catName parameter. An attacker could use this vulnerability to execute illegal SQL commands to...