WordPress and WordPress plugins have SQL injection vulnerabilities

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. A SQL injection vulnerability exists in versions of the WordPress Futurio Extra plugin prior to 1.6.3, which stems from a lack of filtering and escaping of SQL data submitted by users. A highly privileg...

CVE-2021-25109: Improper Neutralization of Special Elements used in an SQL Command

The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting XSS against logged in admins by making send open a malicious link...

CVE-2021-44866: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Online-Movie-Ticket-Booking-System 1.0. The file about.php does not perform input validation on the 'id' paramter. An attacker can append SQL queries to the input to extract sensitive information from the database...

PT-2021-22989

Name of the Vulnerable Software and Affected Versions Genesys intelligent Workload Distribution IWD versions prior to 9.0.013.11 Description A SQL Injection issue in the custom filter query component allows an attacker to execute arbitrary SQL queries via the ql expression parameter. This enables...

CVE-2019-17357

Cacti through 1.2.7 is affected by a graphs.php?templateid= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, ...