CVE-2022-32132

CVE-2022-32132 لـ osTicket | نظام تذاكر الدعم XSS المنعكسة: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...

MISP < 2.5.37 - SQL Injection

MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation. id: CVE-2026-44381 info: name: MISP 2.5.37 - SQL Injection author: malcha severity: medium description: | MISP befo...

CVE-2024-8484

CVE-2024-8484 REST API TO MiniProgram = 4.7.1 - حقن SQL غير مصدق عليه CVE: CVE-2024-8484 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Score: 7.5 Slugs: rest-api-to-miniprogram الوصف: إضافة REST API TO MiniProgram لـ WordPress عرضة لحقن SQL عبر معامل 'order' لنقطة نهاية REST API...

CVE-2019-17671

＃CVE-2019-17671 ＃url + /？static = 1＆order = asc...

CVE-2024-33911

The School Management 10.3.4 - حقن SQL بعد المصادقة عنوان الاستغلال: The School Management 10.3.4 - حقن SQL بعد المصادقة التاريخ: 29 أبريل، 2024 مؤلف الاستغلال: Ivan Spiridonov xbz0n الصفحة الرئيسية للمورّد: https://theschool-management.com الإصدار: 10.3.4 تم الاختبار على: Ubuntu 22.04 CVE:...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 هي ثغرة حقن SQL حرجة تم اكتشافها في إضافة The Events Calendar الخاصة بووردبريس. تؤثر هذه الثغرة على الإصدارات حتى 6.6.4 وما دونها. تنشأ المشكلة من عدم كفاية تهريب معامل 'order' في دالة tribehasnextevent. نظرًا لأن الإدخال لا يتم تطهيره بشكل صحيح، يمكن للمهاجمين غير...

EUVD-2026-92704

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

CVE-2026-88424

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

PT-2026-106090

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

CVE-2026-88424

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

CVE-2026-88424: Undefined Security Weakness

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

CVE-2026-88424

The software FineAdmin v1.0 contains a SQL injection vulnerability within the ButtonService.GetListByFilter() function. The flaw is triggered via the field/order parameter, which allows an attacker to execute crafted SQL statements to access sensitive database information . A Proof of Concept (Po...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Injection SQL aveugle Subscriber+ Prérequis sqlmap installé et des identifiants valides avec le rôle subscriber+ Utilisation usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message a...

CVE-2026-13200

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2026-83551

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-13200 Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2026-95776

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied inp...

CVE-2026-13200: Improper Neutralization of Special Elements used in an SQL Command

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2026-84102

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...