PT-2024-38414 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.9.3 Description: The issue is related to time-based SQL Injection via the order parameter due to insufficient escaping on the user-supplied parameter and lack of sufficien...

ClassCMS Cross-Site Scripting Vulnerability (CNVD-2024-33676)

ClassCMS is China ClassCMS open source a simple , flexible , secure , easy to expand the content management system . ClassCMS cross-site scripting vulnerability , the vulnerability stems from /admin/?action=home&do=shop:index&keyword=&kind=all file in the order parameter contains cross-site...

ClassCMS 跨站脚本漏洞

ClassCMS is China ClassCMS open source a simple , flexible , secure , easy to expand the content management system . ClassCMS cross-site scripting vulnerability , the vulnerability stems from /admin/?action=home&do=shop:index&keyword=&kind=all file in the order parameter contains cross-site...

PT-2024-37970 · Classcms · Classcms

Name of the Vulnerable Software and Affected Versions: ClassCMS version 4.5 Description: A vulnerability has been found in an unknown functionality of the file "/admin/?action=home&do=shop:index&keyword=&kind=all". The manipulation of the order argument leads to cross-site scripting. The attack c...

CVE-2024-6166

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addonsorder’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-5544

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-5544

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

WordPress plugin Media Library Assistant security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-5605

The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mlatagcloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2024-36685 · WordPress · Media Library Assistant

Name of the Vulnerable Software and Affected Versions: Media Library Assistant plugin for WordPress versions up to, and including, 3.16 Description: The issue allows authenticated attackers with contributor-level access and above to perform time-based SQL Injection via the order parameter within...

PT-2024-26995 · Orangehrm · Orangehrm

Name of the Vulnerable Software and Affected Versions: OrangeHRM version 3.3.3 Description: The issue allows for SQL injection in the sortOrder parameter of the admin/viewProjects endpoint. This could potentially be exploited to extract or modify sensitive data. Recommendations: For OrangeHRM...

Exploit for SQL Injection in Weblizar School_Management

The School Management 10.3.4 - Post-Authenticated SQL Injectio...

SQL Injection

librenms/librenms is vulnerable to SQL Injection. The vulnerability is due to inadequate validation of the order parameter sourced from the $request in the file apifunctions.inc.php where the parameter value is directly incorporated into an SQL statement and concatenated. This allows attackers to...

DerbyNet order parameter cross-site scripting vulnerability

DerbyNet is a simple code for a match broadcasting program. A cross-site scripting vulnerability exists in the DerbyNet order parameter due to improper validation of user-supplied input by the checkin.php script. An attacker could use this vulnerability to steal the victim's cookie-based...

DerbyNet 安全漏洞

DerbyNet is a simple code for a match broadcasting program. A cross-site scripting vulnerability exists in the DerbyNet order parameter due to improper validation of user-supplied input by the checkin.php script. An attacker could use this vulnerability to steal the victim's cookie-based...

SUSE CVE-2024-29031

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the order parameter of...

Online Mobile Management Store SQL Injection Vulnerability

Online Mobile Management Store is an online mobile store management system. A SQL injection vulnerability exists in Online Mobile Management Store version 1.0, which originates from a SQL injection vulnerability in the parameter id of the file /admin/orders/vieworder.php...

PT-2024-20229 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns a SQL Injection vulnerability. Specifically, the findInOutMaterialCount function in com.jsh.erp.controller.DepotHeadController does not adequately filter the column and order parameters,...

jshERP SQL Injection Vulnerability

jshERP Huaxia ERP is a homegrown ERP system developed by a Chinese individual developer, Ji Sheng Hua. A SQL injection vulnerability exists in jshERP v3.3, which is caused by insufficient filtering of the "column" and "order" parameters...

Information disclosure

An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the idorder parameter...