CVE-2022-2537: Improper Neutralization of Input During Web Page Generation

The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting...

PT-2022-17247 · WordPress · Woocommerce Pdf Invoices & Packing Slips

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoices & Packing Slips WordPress plugin versions prior to 3.0.1 Description: The issue is related to Reflected Cross-Site Scripting. It occurs because some parameters are not properly sanitised and escaped before being...

CVE-2022-36689: Improper Neutralization of Special Elements used in an SQL Command

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/waste&month=...

CVE-2022-36690: Improper Neutralization of Special Elements used in an SQL Command

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manageuser&id=...

CVE-2022-36686: Improper Neutralization of Special Elements used in an SQL Command

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/stockin&month=...

Zephyr Project Manager < 3.2.5 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=zephyrprojectmanagerprojectspage=--...

CVE-2022-3015: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System. This issue affects some unknown processing of the file admin/?page=reports. The manipulation of the argument date leads to cross site scripting. The attack may be initiated remotely. The...

CVE-2022-36679

Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manageuser...

Sql injection

Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manageuser...

CVE-2022-36679

Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manageuser...

CVE-2022-36679

CVE-2022-36679 affects Simple Task Scheduling System v1.0 . The vulnerability is a SQL injection that can be triggered via the id parameter in the URL /admin/?page=user/manage_user. The available data identify the root cause as unsafely constructed SQL queries exposing both confidentiality and in...

CVE-2022-36679: Improper Neutralization of Special Elements used in an SQL Command

Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manageuser...

PT-2022-23547

Name of the Vulnerable Software and Affected Versions Simple Task Scheduling System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/?page=user/manage user" API endpoint. Recommendations For Simp...

CVE-2022-36716

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/changestock.php...

CVE-2022-36721

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Textbook parameter at /admin/modify.php...

Sql injection

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the ok parameter at /admin/history.php...

Sql injection

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Textbook parameter at /admin/modify.php...

WooCommerce PDF Invoices & Packing Slips < 3.0.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting. This is a re-introduction of CVE-2021-24991 in 2.14.0 PoC...

CVE-2022-0899

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting...