Sql injection

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

Sql injection

The getpollcategories, getpolls and getreports functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24456

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

CVE-2021-24459

The getresults and getitems functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24483 Poll Maker < 3.2.1 - Authenticated Blind SQL Injections

The getpollcategories, getpolls and getreports functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24483

Affected software: WordPress Poll Maker plugin (prior to version 3.2.1). Vulnerability: SQL injection in admin dashboard via unsafely used orderby parameter in get_results() calls within get_poll_categories(), get_polls(), and get_reports(). Root cause: lack of whitelist/validation for orderby us...

CVE-2021-24459 Survey Maker < 1.5.6 - Authenticated Blind SQL Injections

The getresults and getitems functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24459

The CVE-2021-24459 entry concerns the WordPress Survey Maker plugin (before 1.5.6). The root cause is that get_results() and get_items() do not whitelist or validate the orderby parameter before using it in SQL statements, leading to SQL injection in the admin dashboard. Impact is authenticated S...

CVE-2021-24456 Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

CVE-2021-24456

CVE-2021-24456 affects WordPress Quiz Maker plugin up to version 6.2.0.9. The vulnerability stems from insufficient sanitization/escaping of the order and orderby parameters used in SQL statements, enabling SQL injection in the admin dashboard. Confirmed sources (Red Hat, CVE/NVD/CVEList, CNVD, W...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. WordPress plugin has a security vulnerability that originates from the mcount parameter in the file Poll - Maker -settings.php via admin partial settings Poll - Maker -settings.php, the Poll Maker WordPress plugin is susceptible...

WordPress和WordPress 插件 SQL注入漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Poll Maker Plugin is an application plugin for WordPress. A security vulnerability exists in WordPress Poll Maker...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Survey Maker prior to version 1.5.6,...

WordPress SQL注入漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Quiz Maker plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress Quiz Maker...

Poll Maker < 3.2.9 - Reflected Cross-Site Scripting

The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the /admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8. PoC...

Poll Maker < 3.2.9 - Reflected Cross-Site Scripting

The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the /admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8...

WordPress Poll Maker plugin <= 3.2.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Xu-Liang Liao in WordPress Poll Maker plugin versions = 3.2.8. Solution Update the WordPress Poll Maker plugin to the latest available version at least 3.2.9...

Form Maker < 1.13.60 - Authenticated Stored XSS

The plugin does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue PoC Create or edit a form and add the following payload in the Form Title field "autofocus...

WordPress Form Maker plugin <= 1.13.59 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Felipe Restrepo Rodriguez in WordPress Form Maker plugin versions = 1.13.59. Solution Update the WordPress Form Maker plugin to the latest available version at least 1.13.60...

Form Maker < 1.13.60 - Authenticated Stored XSS

The plugin does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Create or edit a form and add the following payload in the Form Title field "autofocus onmouseover=alert/XSS///...