CVE-2020-21012

Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details...

Cross-Site Request Forgery (CSRF) in collectiveaccess/providence

Description I have found more endpoints which allow edit/duplicate were not protected from CSRF, the following endpoints are: 1: Edit Global Value in Pawtucket. 2: Change object type. 3: Duplicate object. 4: Duplicate items in the set and add to another set. Proof of Concept Via GET requests: 1...

WordPress Edit Comments Plugin SQL injection (CVE-2021-24551)

An SQL injection vulnerability exists in WordPress Edit Comments plugin. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

OESA-2021-1349 ansible security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

AES256_Passwd_Store - Secure Open-Source Password Manager

This script securely encrypts or decrypts passwords on disk within a custom database file. It also features functionality to retrieve passwords from a previously generated database file. This script takes a master password from stdin/from memory, then hashes the password using the specified hashi...

UBUNTU-CVE-2020-23273

Heap-buffer overflow in the randomizeiparp function in editpacket.c. of Tcpreplay v4.3.2 allows attackers to cause a denial of service DOS via a crafted pcap...

GHSA-M9FQ-C9HP-59G7 Cross-site Scripting in yourls

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in edit dialog...

Cross-site Scripting in yourls

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in edit dialog...

CVE-2021-24401

The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an editid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24585

The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts...

CVE-2021-24400

The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24401

The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an editid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24397

The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

Sql injection

The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

Sql injection

The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24400

The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24583

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the editposts capability contributor+ to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such...

Sql injection

The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an editid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24401

CVE-2021-24401 affects the WP Domain Redirect WordPress plugin (

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in MicroCopy WordPress plugin 1.1.0 and earlier versions. The...