CVE-2024-0952: Improper Neutralization of Special Elements used in an SQL Command

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of...

SQL Injection Vulnerability in Data Leakage Protection (DLP) System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-22743)

Beijing Yisetong Technology Development Co., Ltd. is a domestic data security, network security and security services provider of three major business. A SQL injection vulnerability exists in the Data Leakage Protection DLP system of Beijing Yisetong, which can be exploited by attackers to obtain...

IBM Db2 信息泄露漏洞

IBM Db2 is a relational database management system from International Business Machines IBM. The system executes on UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM Db2 suffers from an information disclosure vulnerability that originates when ADMINCMD is used in conjunction with IMPORT o...

CVE-2024-1711: Improper Neutralization of Special Elements used in an SQL Command

The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.9.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-2592

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/person/picshow.php, in the 'personid' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

CVE-2024-2586: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/index.php, in the 'username' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

PT-2024-21151

Name of the Vulnerable Software and Affected Versions AMSS++ version 4.31 Description The issue allows SQL injection through the "/amssplus/modules/book/main/select send.php" API endpoint, specifically in the sd index parameter. This could enable a remote attacker to send a specially crafted SQL...

CVE-2024-2584: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/selectsend.php, in the 'sdindex' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

PT-2024-21176

Name of the Vulnerable Software and Affected Versions AMSS++ version 4.31 Description The issue allows SQL injection through the "/amssplus/modules/book/main/bookdetail khet person.php" endpoint, in multiple parameters. This could allow a remote attacker to send a specially crafted SQL query to t...

CVE-2024-2591: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetailgroup.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

CVE-2024-2589: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetailschoolperson.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in th...

CVE-2024-2590: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/mail/main/selectsend.php, in the 'sdindex' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

CVE-2024-1793: Improper Neutralization of Special Elements used in an SQL Command

The AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 7.3.14 due to insufficient escaping on the user supplied parameter an...

CVE-2024-1203: Improper Neutralization of Special Elements used in an SQL Command

The Conversios – Google Analytics 4 GA4, Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-0594: Improper Neutralization of Special Elements used in an SQL Command

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parameter of the wpasgetusers action in all versions up to, and including, 6.1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient...

SQL Injection Vulnerability in Ruiyou Tianyi Application Virtualization System

Xi'an Ruiyou Information Technology Co., Ltd. is a professional virtualization and cloud computing solution provider. A SQL injection vulnerability exists in Ruiyou Tianyi Application Virtualization System, which can be exploited by attackers to obtain database information and execute commands...

CVE-2020-26630

A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a special payload in the 'Doctor Specialization' field under the 'Go to Doctors' tab after logging in as an admin...

CVE-2020-26627: Improper Neutralization of Special Elements used in an SQL Command

A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a crafted payload entered into the 'Admin Remark' parameter under the 'Contact Us Queries - Unread Query' tab...

Tencent TDSQL 安全漏洞

Tencent tdsql is a distributed database from the Chinese company Tencent Tencent. An unspecified vulnerability exists in Tencent TDSQL, which can be exploited by an attacker to discover database information...

PT-2023-11749

Name of the Vulnerable Software and Affected Versions Hospital Management System version 4.0 Description A Time-Based SQL Injection issue was discovered, allowing an attacker to dump database information via a crafted payload entered into the Admin Remark parameter under the "Contact Us Queries -...