PT-2024-39231 · WordPress · Wp Post Author

Name of the Vulnerable Software and Affected Versions: WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress versions up to, and including, 3.8.1 Description: The...

CVE-2024-9201

The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘idorder’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint...

CVE-2024-9201

The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘idorder’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint...

CVE-2024-9201

The SEUR Oficial plugin is affected by a time-based SQL injection in versions before 2.5.11, exploitable via the id_order parameter at /modules/seur/ajax/saveCodFee.php. Patch to 2.5.11+ (or later) to fix; the vulnerability is documented with high-severity CVSS metrics and patch status indicating...

CVE-2024-9201 SQL injection vulnerability in SEUR plugin

The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘idorder’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint...

PT-2024-39484 · Unknown · Seur Plugin

Name of the Vulnerable Software and Affected Versions: SEUR plugin versions prior to 2.5.11 Description: The SEUR plugin is vulnerable to time-based SQL injection through the use of the id order parameter of the "/modules/seur/ajax/saveCodFee.php" endpoint. This issue affects versions prior to...

SEUR plugin SQL注入漏洞

SEUR plugin is a Prestahop plugin from SEUR. A SQL injection vulnerability exists in SEUR plugin versions prior to 2.5.11, which stems from a time-based SQL injection attack via the idorder parameter...

U.S. Dept Of Defense: Time-based blind SQL injection

A time-based blind SQL injection vulnerability was discovered in the sortBy parameter of the web application's SearchDocs.aspx functionality. The vulnerability was identified by observing differences in the server's response time when specific payloads were used. This type of vulnerability could...

CVE-2024-9018

The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

WordPress plugin WP Easy Gallery SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A SQL injection...

PT-2024-39366 · WordPress · Wp Easy Gallery

Name of the Vulnerable Software and Affected Versions: The WP Easy Gallery – WordPress Gallery Plugin versions up to, and including, 4.8.5 Description: The issue is related to time-based SQL Injection via the key parameter due to insufficient escaping on the user-supplied parameter and lack of...

CVE-2024-9130

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2024-9130

The CVE-2024-9130 entry cites a time-based SQL Injection in GiveWP – Donation Plugin and Fundraising Platform for WordPress, affecting all versions up to 3.16.1. The root cause is insufficient escaping of the order parameter and inadequate query preparation, allowing authenticated attackers (Give...

WordPress plugin GiveWP SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

U.S. Dept Of Defense: SQL Injection

The application was found to have a blind SQL injection vulnerability in the 'filterevent' parameter. The vulnerability allowed an attacker to manipulate database queries and extract sensitive information from the database through time-based or boolean-based techniques, as the injection was blind...

Devise-Two-Factor 安全漏洞

Devise-Two-Factor is a minimalist extension of Devise to the Devise-Two-Factor open source. It is used to provide support for two-factor authentication via TOTP schemes. A security vulnerability exists in Devise-Two-Factor versions 2.2.0 and earlier and 6.0.0 and earlier, which stems from an...

VICIdial 2.14-917a SQL Injection Vulnerability

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial version 2.14-917a to enumerate database records. By default, VICIdial stores plaintext credentials within the database. Title: VICIdial Unauthenticated SQL Injection Publication URL:...

VICIdial 2.14-917a SQL Injection

KL-001-2024-011: VICIdial Unauthenticated SQL Injection Title: VICIdial Unauthenticated SQL Injection Advisory ID: KL-001-2024-011 Publication Date: 2024-09-10 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt 1. Vulnerability Details Affected Vendor: VICIdial Affect...

VICIdial Unauthenticated SQL Injection

Vulnerability Details Affected Vendor: VICIdial Affected Product: VICIdial Affected Version: 2.14-917a Platform: GNU/Linux CWE Classification: CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CVE ID: CVE-2024-8503 2. Vulnerability Description An...

Vicidial SQL Injection Time-based Admin Credentials Enumeration

This module exploits a time-based SQL injection vulnerability in VICIdial, allowing attackers to dump admin credentials usernames and passwords via SQL injection. Module Options msf use auxiliary/scanner/http/vicidial/sqlenumuserspass msf undefinedsqlenumuserspass show actions ...actions... msf...