SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection due to improper escaping of a query parameter in the postgres64, postgres7, postgres8, and postgres9 drivers. An attacker can execute arbitrary SQL statements by injecting malicious SQL code into the pginsertid method...

PT-2019-7735

Name of the Vulnerable Software and Affected Versions podlove-podcasting-plugin-for-wordpress versions prior to 2.3.16 Description The issue concerns SQL injection via the insert id parameter, which is exploitable via CSRF. This allows for potential manipulation of database queries. Recommendatio...