Sql injection

Secure 8 Evalos does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database...

CVE-2021-3604

CVE-2021-3604 affects Primion Secure 8 (Evalos); root cause is improper validation of user input data that enables a blind SQL injection. This allows a remote attacker to extract information from the database, including user and administrator accounts. The provided documents do not specify a reme...

CVE-2021-3604

Secure 8 Evalos does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database...

CVE-2021-3604: Improper Neutralization of Special Elements used in an SQL Command

Secure 8 Evalos does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database...

PT-2021-21102

Name of the Vulnerable Software and Affected Versions: Secure 8 Evalos affected versions not specified Description: The issue arises from incorrect validation of user input data, allowing a remote attacker to perform a Blind SQL Injection. This could be exploited to extract information from user...

CVE-2021-32582

An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses...

CVE-2021-32582

The CVE-2021-32582 entry concerns ConnectWise Automate (before 2021.5). The vulnerability is a blind SQL injection in the core agent inventory communication, exposed via crafted monitor status responses. The issue could allow an attacker to extract database information or administrative credentia...

CVE-2021-32582

An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses...

PT-2021-19796

Name of the Vulnerable Software and Affected Versions ConnectWise Automate versions prior to 2021.5 Description A blind SQL injection issue exists in core agent inventory communication, allowing an attacker to extract database information or administrative credentials from an instance via crafted...

CVE-2021-32582: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses...

CVE-2021-24360

The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users contributor+ to perform Blind SQL Injection attacks...

CVE-2021-24345

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

CVE-2021-24345

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

Sql injection

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

Sql injection

The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users contributor+ to perform Blind SQL Injection attacks...

CVE-2021-24360

Yes/No Chart WordPress plugin (before 1.0.12) is vulnerable due to unsanitized sid shortcode parameter used in SQL statements, enabling blind SQL injection by medium-privilege users (contributor+). Root cause: input not sanitized before query construction. Impact: potential data exposure through ...

CVE-2021-24345

The CVE-2021-24345 entry describes a SQL Injection in the Sendit WP Newsletter WordPress plugin (versions ≤ 2.5.1) that is exploitable by an Administrator user via the id_lista POST parameter in the lists-management feature. The underlying issue is lack of sanitization/escaping of id_lista before...

CVE-2021-24345: Improper Neutralization of Special Elements used in an SQL Command

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

PT-2021-15881

Name of the Vulnerable Software and Affected Versions Sendit WP Newsletter WordPress plugin versions 2.5.1 and earlier Description The issue concerns the page lists-management feature of the plugin, which is accessible to Administrator users. It does not properly sanitise, validate, or escape the...

PT-2021-15896

Name of the Vulnerable Software and Affected Versions Yes/No Chart WordPress plugin versions prior to 1.0.12 Description The issue allows medium privilege users, specifically those with contributor or higher privileges, to perform Blind SQL Injection attacks due to the lack of sanitization of the...