CVE-2025-10582 WP Dispatcher <= 1.2.0 - Authenticated (Contributor+) SQL Injection

The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticat...

CVE-2025-10582 WP Dispatcher <= 1.2.0 - Authenticated (Contributor+) SQL Injection

The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticat...

CVE-2025-10582

CVE-2025-10582 affects the WP Dispatcher WordPress plugin. It is an SQL Injection via the id parameter in all versions up to 1.2.0 due to insufficient escaping and lack of proper query preparation. Authenticated attackers with Contributor-level access and above can append additional SQL queries t...

CVE-2025-10726

CVE-2025-10726 (WPRecovery) affects WordPress WPRecovery plugin up to version 2.0. It describes an unauthenticated SQL Injection via data[id] that can cause leakage of sensitive data and, via the query result being passed to unlink(), arbitrary file deletion on the server. The Wordfence report co...

PT-2025-40475

Name of the Vulnerable Software and Affected Versions WPRecovery versions prior to 2.1 Description The WPRecovery plugin for WordPress is affected by a SQL Injection issue due to insufficient input validation and preparation of SQL queries. Specifically, the dataid parameter is vulnerable. This...

PT-2025-40474

Name of the Vulnerable Software and Affected Versions WP Dispatcher plugin for WordPress versions up to and including 1.2.0 Description The WP Dispatcher plugin for WordPress is susceptible to SQL Injection via the id parameter. Insufficient escaping of user-supplied input and a lack of proper SQ...

CVE-2025-6941

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepointresources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escapin...

CVE-2025-6941

CVE-2025-6941 is a stored XSS in the WordPress plugin LatePoint (Calendar Booking Plugin for Appointments and Events). The issue arises from insufficient input sanitization/escaping in the id parameter of the latepoint_resources shortcode, affecting all versions up to and including 5.1.94. Exploi...

PT-2025-39955

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.1.94 Description The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is...

CVE-2025-11135

The CVE-2025-11135 entry concerns pmTicket Project-Management-Software, specifically the Cookie Handler component’s loadLanguage function in file classes/class.database.php. The issue arises from manipulation of the user_id argument that leads to deserialization, with remote exploitability. Publi...

E-Commerce Website admin_account_update.php file SQL injection vulnerability

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter userid in the file /pages/adminaccountupdate.php. An attacker can exploit this vulnerabili...

CVE-2025-11111

A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/candidatesedit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to...

CVE-2025-11111

A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/candidatesedit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to...

CVE-2025-11109

A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/usedit.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is...

CVE-2025-11109 Campcodes Computer Sales and Inventory System us_edit.php sql injection

A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/usedit.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is...

Code-Projects E-Commerce Website SQL注入漏洞

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the pages/adminproductdetails.php file that does not perform security filtering on the prodid parameter. An attacker can exploit this vulnerability by manipulating the...

itsourcecode Open Source Job Portal SQL注入漏洞

itsourcecode Open Source Job Portal is an enterprise portal site of itsourcecode open source. A SQL injection vulnerability exists in version 1.0 of itsourcecode Open Source Job Portal, which stems from incorrect manipulation of the parameter ID in the file /admin/employee/index.php, which could...

CampCodes Computer Sales and Inventory System SQL注入漏洞

CampCodes Computer Sales and Inventory System is a computerized sales and inventory system from CampCodes Philippines. CampCodes Computer Sales and Inventory System version 1.0 suffers from a SQL injection vulnerability that stems from incorrect manipulation of the parameter ID in the file...

CVE-2025-11036

A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/adminaccountupdate.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be...

CVE-2025-11066

A flaw has been found in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/bidlist.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used...