CVE-2024-3067: Improper Neutralization of Special Elements used in an SQL Command

The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2024-1601: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability exists in the deletediscussion function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. The vulnerability is exploitable via a crafted HTTP POST request to the /deletediscussion endpoint, which internally...

PT-2024-27717 · Unknown · Phpgurukul Student Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Student Record System version 3.20 Description: A critical issue was found in the PHPGurukul Student Record System, affecting an unknown function of the file /login.php. The manipulation of the id and password arguments leads to SQ...

PT-2024-27221 · Sourcecodester · Sourcecodester Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Laboratory Management System version 1.0 Description: A security issue has been found that allows cross-site scripting XSS attacks. This is due to the manipulation of the id argument in the /classes/Users.php file, whi...

Campcodes House Rental Management System SQL Injection Vulnerability

Campcodes House Rental Management System is a house rental management system from Campcodes, Inc. A SQL injection vulnerability exists in version 1.0 of the Campcodes House Rental Management System, which results from an SQL injection in the id parameter of the viewpayment.php file...

PT-2024-19537 · Unknown · Form Tools

Name of the Vulnerable Software and Affected Versions: Form Tools version 3.1.1 Description: A Cross Site Scripting XSS issue allows attackers to run arbitrary code via the client id parameter in the application URL. This enables attackers to potentially execute malicious scripts on the...

CVE-2024-22718

A Cross Site Scripting (XSS) vulnerability exists in Form Tools version 3.1.1 . The issue is caused by improper neutralization of input within the client_id parameter in the application URL, which allows attackers to run arbitrary code on the client-side. As a temporary workaround, it is recommen...

PT-2024-18478 · WordPress · Registrationmagic

Name of the Vulnerable Software and Affected Versions: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress versions up to, and including, 5.3.1.0 Description: The issue is related to blind SQL Injection via the id parameter of the RM Form...

CVE-2024-0952: Improper Neutralization of Special Elements used in an SQL Command

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-1990: Improper Neutralization of Special Elements used in an SQL Command

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RMForm shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied...

CVE-2024-2226: Improper Input Validation

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id parameter in the google-map block in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This...

CVE-2024-31506: Improper Neutralization of Special Elements used in an SQL Command

Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admincs.php...

PT-2024-26394 · Unknown · Campcodes Online Event Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Event Management System version 1.0 Description: A critical vulnerability was found in the system, affecting unknown code in the file /views/index.php. The manipulation of the ID argument leads to SQL injection. The attack ca...

Online Courseware SQL Injection Vulnerabilities

DPEC Online Courseware is an online courseware system from DPEC Corporation. A SQL injection vulnerability exists in version 1.0 of Online Courseware, which originates from an SQL injection attack on the id parameter of the admin/edit.php file...

Online Courseware Security Vulnerabilities

DPEC Online Courseware is an online courseware system from DPEC Corporation. A security vulnerability exists in Online Courseware version 1.0, which can be exploited for cross-site scripting attacks due to the id parameter in the edit.php file...

PT-2024-25735 · Sourcecodester · Sourcecodester Online Courseware

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Courseware version 1.0 Description: A critical issue was found in the software, affecting some unknown functionality of the file admin/saveedit.php. The manipulation of the id argument leads to sql injection. The attack...

PT-2024-25723 · Sourcecodester · Sourcecodester Online Courseware

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Courseware version 1.0 Description: A critical issue was found in the admin/editt.php file, where the manipulation of the id argument leads to SQL injection. The attack can be initiated remotely. Recommendations: For...

PT-2024-25774 · Sourcecodester · Sourcecodester Online Courseware

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Courseware version 1.0 Description: A problematic issue has been found in the file editt.php, where the manipulation of the id argument leads to cross-site scripting. The attack can be launched remotely. Recommendations:...

PT-2024-25778 · Sourcecodester · Sourcecodester Online Courseware

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Courseware version 1.0 Description: A problematic issue has been found in the software, affecting the file edit.php. The manipulation of the id argument leads to cross-site scripting. The attack can be initiated remotely...

Online Library System Cross-Site Script Vulnerabilities

Online Library System is an open source online library system. A cross-site scripting vulnerability exists in SourceCodester Online Library System version 1.0, which originates from a cross-site scripting vulnerability in the id parameter of the admin/books/index.php file...