PT-2026-73115

Name of the Vulnerable Software and Affected Versions User Login History versions prior to 2.1.8 Description The User Login History plugin for WordPress contains a SQL Injection flaw, which occurs when an application fails to properly sanitize or escape input used in a database query, allowing an...

CVE-2026-5144 BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR

The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3. This is due to the group blog settings handler accepting the groupblog-blogid, default-member, and groupblog-silent-add parameters from user input without proper...

CVE-2024-13204

A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /blog-details.php. The manipulation of the argument blogid leads to sql injection. The attack can be launched remotely. The...

PT-2025-2062 · Unknown · Kurniaramadhan E-Commerce-Php

Name of the Vulnerable Software and Affected Versions: kurniaramadhan E-Commerce-PHP version 1.0 Description: A critical issue affects an unknown functionality of the file /blog-details.php. The manipulation of the blog id argument leads to SQL injection. The attack can be launched remotely. The...

Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API

The plugin does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization. curl --json ' "media": "tmpname": "/WPCONTENTPATH/wp-config.php",...

Sql injection

Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blogid parameter at /blog/blog.php...

PT-2022-18417

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description The issue is a SQL injection vulnerability. It can be exploited via the blog id parameter at the "/blog/blog.php" API endpoint. Recommendations For Chamilo LMS version 1.11.13, avoid using the blog id...

CVE-2018-6363

SQL Injection exists in Task Rabbit Clone 1.0 via the singleblog.php id parameter...

PT-2014-6162

Name of the Vulnerable Software and Affected Versions Blogstand Banner plugin version 1.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the bs blog id parameter to "wp-admin/options-general.php". Recommendations For Blogstand Banne...

PT-2011-1794

Name of the Vulnerable Software and Affected Versions WebAsyst Shop-Script affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the blog id parameter in a "news" action, specifically targeting the index.php file...

BoastMachine 3.1 - mail.php id SQL Injection

BoastMachine 3.1 - mail.php id SQL Injection ...:::::boastMachine =3.1 SQL Injection Vulnerbility ::::.... Virangar Security Team www.virangar.org www.virangar.net -------- Discoverd By :virangar security teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members &...