66 matches found
CVE-2022-0693
The Master Elements WordPress plugin through 8.0 does not validate and escape the metaids parameter of its removepostmetacondition AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL Injection...
CVE-2022-0785
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the getmonthlytimetable AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...
PT-2022-12164 · Unknown · Rosariosis
Name of the Vulnerable Software and Affected Versions: RosarioSIS versions prior to 7.6.1 Description: An unauthenticated SQL Injection issue exists via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php. Recommendations: For versions prior to 7.6.1, update to version 7.6.1 or later...
CVE-2021-24943
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the eventid in the rtecsendunregisterlink AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL injection...
CVE-2019-18387
Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the id parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details...