Sql injection

The School Management System WordPress plugin before 2.2.5 uses the WordPress escsql function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers...

CVE-2021-24340

The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress escsql function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including...

WordPress 'esc_sql' Function SQL Injection Vulnerability (Nov 2017) - Linux

WordPress is prone to an SQL injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress";...

Wordpress Plugin Single Personal Message 1.0.3 SQL injection vulnerability

Author:sebaoknow Chong Yu 404 security lab Date:2016-12-06 1. Vulnerability description Simple Personal Message is for WordPress website dedicated to create the privacy and security of information systems. Using Ajax operation, may be based on a group of users between the station within the...

WordPress Video Player 1.5.16 Plugin - SQL Injection

Exploit for php platform in category web applications !-- Multiple SQL injection vulnerabilities in WordPress Video Player Abstract It was discovered that WordPress Video Player is affected by multiple blind SQL injection vulnerabilities. Using these issues it is possible for a logged on...

WordPress Plugin All In One WP Security Firewall 3.9.0 - SQL Injection

WordPress Plugin All In One WP Security Firewall 3.9.0 - SQL Injection Exploit Title : WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability Exploit Author : Claudio Viviani Vendor Homepage : https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/ Software Link ...

All In One WP Security & Firewall <= 3.9.0 - Blind SQL Injection

There are some pages which use the WordPress escsql function incorrectly. PoC http://www.example.com/wp-admin/admin.php?page=aiowpsec=tab3=userid,select from selectsleep30a=asc...

WordPress All In One WP Security And Firewall 3.9.0 SQL Injection

Exploit Title : WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability Exploit Author : Claudio Viviani Vendor Homepage : https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/ Software Link :...