JVN#92828286: Welcart vulnerable to SQL injection

Welcart provided by Collne Inc. is a WordPress plugin for creating shopping websites. Welcart contains a SQL injection CWE-89 vulnerability due to the processing of changeSort parameter in admin.php. Impact An attacker that can log in to WordPress with this plugin enabled may obtain or alter...

JVN#19011483: Thetis vulnerable to SQL injection

Thetis provided by Sysphonic Co., Ltd. is an open source groupware and SNS. Thetis contains a SQL injection CWE-89 vulnerability. Impact An attacker may obtain or alter information stored in the database. Solution Apply an Update Apply the update according to the information provided by the...

[SYSS-2015-031] sysPass - SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-031 Product: sysPass Vendor: http://cygnux.org/ Affected Versions: 1.0.9 and below Tested Versions: 1.0.9 Vulnerability Type: SQL Injection CWE-89 Risk Level: High Solution Status: Fixed Vendor Notification: 2014-07-27 Solutio...

sysPass 1.0.9 - SQL Injection Vulnerability

Exploit for php platform in category web applications Product: sysPass Vendor: http://cygnux.org/ Affected Versions: 1.0.9 and below Tested Versions: 1.0.9 Vulnerability Type: SQL Injection CWE-89 Risk Level: High Solution Status: Fixed Vendor Notification: 2014-07-27 Solution Date: 2014-08-04...

JVN#52478686: MilkyStep vulnerable to SQL injection

MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep contains a SQL injection vulnerability CWE-89. Impact An attacker who can access the product may execute an arbitrary SQL command. Solution Update the Software Update to the latest version accordin...

WordPress LeagueManager 3.9.11 SQL Injection

Exploit Title: WordPress LeagueManager SQLi Version: 3.9.11 Vendor: https://wordpress.org/plugins/leaguemanager Software Link: https://downloads.wordpress.org/plugin/leaguemanager.3.9.1.1.zip Author: javabudd Date: 06/01/2015 Tested on: Linux | Windows Vulnerabilities 2 ==========================...

WordPress Plugin LeagueManager 3.9.11 - SQL Injection

Exploit Title: WordPress LeagueManager SQLi Version: 3.9.11 Vendor: https://wordpress.org/plugins/leaguemanager Software Link: https://downloads.wordpress.org/plugin/leaguemanager.3.9.1.1.zip Author: javabudd Date: 06/01/2015 Tested on: Linux | Windows Vulnerabilities 2 ==========================...

WordPress Plugin Landing Pages 1.8.4 - Multiple Vulnerabilities

Title: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/landing-pages/ Active installs: 20,000+ Vulnerable version: 1.8.4 Fixed version: 1.8.5 CVE: CVE-2015-4064,...

WordPress Plugin GigPress 2.3.8 - SQL Injection

WordPress Plugin GigPress 2.3.8 - SQL Injection Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+ Vulnerable version: 2.3.8 Fixed version: 2.3.9...

WordPress GigPress 2.3.8 SQL Injection Vulnerability

WordPress GigPress plugin version 2.3.8 suffers from a remote SQL injection vulnerability. Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+...

WordPress Plugin GigPress 2.3.8 - SQL Injection

Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+ Vulnerable version: 2.3.8 Fixed version: 2.3.9 CVE: CVE-2015-4066 Vulnerabilities 2...

WordPress GigPress 2.3.8 SQL Injection

Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+ Vulnerable version: 2.3.8 Fixed version: 2.3.9 CVE: CVE-2015-4066 Vulnerabilities 2...

WordPress FeedWordPress Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1...

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1...

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection

Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1 Authenticated SQLi CWE-89 -------------------------------...

WordPress FeedWordPress 2015.0426 SQL Injection

Exploit Title: SQLi in FeedWordPress WordPress plugin Date: 2015-05-19 Exploit Author: Adrián M. F. Vendor Homepage: https://wordpress.org/plugins/feedwordpress/ Vulnerable version: 2015.0426 Fixed version: 2015.0514 CVE : CVE-2015-4018 1 Authenticated SQLi CWE-89 -------------------------------...

Subrion CMS vulnerable to SQL injection by an authenticated user

Overview Subrion CMS is vulnerable to SQL injection from authenticated users when a browser cookie is modified in a certain way. Description Subrion is an open source web-based content management system CMS. Subrion is vulnerable to SQL injection due to deserialization of untrusted data from a...

SQL Injection in Huge IT Slider WordPress Plugin

Advisory ID: HTB23250 Product: Huge IT Slider WordPress Plugin Vendor: Huge-IT Vulnerable Versions: 2.6.8 and probably prior Tested Version: 2.6.8 Advisory Publication: February 19, 2015 without technical details Vendor Notification: February 19, 2015 Vendor Patch: March 11, 2015 Public Disclosur...

724CMS 5.01 / 4.59 / 4.01 / 3.01 SQL Injection

724CMS 5.01 Multiple SQL Injection Security Vulnerabilities Exploit Title: 724CMS Multiple SQL Injection Security Vulnerabilities Vendor: 724CMS Product: 724CMS Vulnerable Versions: 3.01 4.01 4.59 5.01 Tested Version: 5.01 Advisory Publication: March 14, 2015 Latest Update: March 14, 2015...

Vastal I-tech phpVID 1.2.3 SQL Injection

Vastal I-tech phpVID 1.2.3 SQL Injection Security Vulnerabilities Exploit Title: Vastal I-tech phpVID /groups.php Multiple Parameters SQL Injection Security Vulnerabilities Product: phpVID Vendor: Vastal I-tech Vulnerable Versions: 1.2.3 0.9.9 Tested Version: 1.2.3 0.9.9 Advisory Publication: Mar...