Webkul QloApps Security Breach

Webkul QloApps is free open source hotel booking and online reservation system. A security vulnerability exists in Webkul QloApps versions prior to v1.6.0, which stems from a vulnerability that allows an attacker to obtain sensitive information via the idorder parameter...

Weitong Mall SQL Injection Vulnerability

Weitong Mall is a shopping mall system developed by fuyanglipengjun. A SQL injection vulnerability exists in Weitong Mall version 1.0.0, which originates from platform-shopsrcmain. The vulnerability is caused by an unknown function in platform-shopsrcmain.esourcescomplatformdaoOrderDao.xml, which...

PT-2023-8392 · Nginx-Ui · Nginx-Ui

Name of the Vulnerable Software and Affected Versions: Nginx-UI versions prior to 2.0.0.beta.9 Description: The issue is related to a lack of protection against SQL query structure exploitation in the Nginx UI server. This may allow a remote attacker to gain unauthorized access to protected...

GHSA-9JJC-GRG5-67GJ SQL injection vulnerability in Meshery

A SQL injection vulnerability in Meshery before 0.6.179 allows a remote attacker to obtain sensitive information and execute arbitrary code via the order parameter...

CVE-2023-46575

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter...

CVE-2023-46575

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter...

PT-2023-30096 · Meshery · Meshery

Name of the Vulnerable Software and Affected Versions: Meshery versions prior to 0.6.179 Description: A SQL injection issue exists, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the order parameter. Recommendations: For versions prior to 0.6.179,...

CVE-2023-46575

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter...

CVE-2023-46575

A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter...

Dooblou WiFi File Explorer 跨站脚本漏洞

Dooblou WiFi File Explorer is a free WiFi file explorer from Dooblou. A cross-site scripting vulnerability exists in Dooblou WiFi File Explorer version 1.13.3, which stems from the parameter search/order/download/mode that causes cross-site scripting...

QuickJob Portal 6.1 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

CVE-2023-2607

The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2023-20465 · WordPress · Multiple Page Generator Plugin

Name of the Vulnerable Software and Affected Versions: Multiple Page Generator Plugin for WordPress versions up to, and including, 3.3.17 Description: The issue allows for time-based SQL Injection via the orderby and order parameters due to insufficient escaping on the user-supplied parameter and...

PT-2023-19818 · WordPress · Active Directory Integration

Name of the Vulnerable Software and Affected Versions: Active Directory Integration plugin for WordPress versions up to and including 4.1.4 Description: The issue allows for time-based SQL Injection due to insufficient escaping on the user-supplied orderby and order parameters and lack of...

CVE-2023-2608

The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projectslist function and insufficient escaping o...

CVE-2023-2608

The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projectslist function and insufficient escaping o...

CVE-2022-31890

SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...

PT-2023-13055 · Osticket · Osticket

Name of the Vulnerable Software and Affected Versions: osTicket-plugins versions prior to commit a7842d494889fd5533d13deb3c6a7789768795ae Description: The issue is related to a SQL Injection vulnerability in the audit/class.audit.php file. It can be exploited via the order parameter to the getOrd...

CVE-2022-31890

SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function...

CVE-2022-48329

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...