392 matches found
CVE-2019-17671
＃CVE-2019-17671 ＃url + /？static = 1＆order = asc...
MISP < 2.5.37 - SQL Injection
MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation. id: CVE-2026-44381 info: name: MISP 2.5.37 - SQL Injection author: malcha severity: medium description: | MISP befo...
CVE-2024-33911
The School Management 10.3.4 - SQL-Injection nach Authentifizierung Exploit-Titel: The School Management 10.3.4 - SQL-Injection nach Authentifizierung Datum: 29. April 2024 Exploit-Autor: Ivan Spiridonov xbz0n Hersteller-Website: https://theschool-management.com Version: 10.3.4 Getestet auf:...
CVE-2022-32132
CVE-2022-32132 per osTicket | Sistema di ticketing di supporto XSS riflesso: root@kitploit: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...
CVE-2024-8275
CVE-2024-8275 CVE-2024-8275 è una vulnerabilità critica di SQL injection scoperta nel plugin WordPress The Events Calendar. Questa vulnerabilità colpisce le versioni fino alla 6.6.4 inclusa. Il problema deriva da un escaping insufficiente del parametro 'order' nella funzione tribehasnextevent...
CVE-2022-0439
CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ 블라인드 SQL 인젝션 필수 사항 sqlmap이 설치되어 있어야 하며, subscriber+ 권한을 가진 유효한 사용자 이름과 비밀번호가 필요합니다. 사용법 root@kitploit: usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w...
CVE-2024-8484
CVE-2024-8484 REST API TO MiniProgram = 4.7.1 - SQL Injection non autenticata root@kitploit: CVE: CVE-2024-8484 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Score: 7.5 Slugs: rest-api-to-miniprogram Descrizione: Il plugin REST API TO MiniProgram per WordPress è vulnerabile a SQL...
CVE-2026-18884 WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
EUVD-2026-66333
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
EUVD-2026-54308
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
CVE-2026-67689
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
CVE-2026-67689
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
CVE-2026-67689
CVE-2026-67689 concerns FineAdmin V1.0 where the vulnerability arises in the paginated list endpoints through the field and order parameters, enabling SQL injection via unsafely constructed ORDER BY clauses. Connected sources describe that FineAdmin.Mvc’s GetListByFilter()/GetPageUnite() concaten...
CVE-2026-67689
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
CVE-2026-11920
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-11920
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
EUVD-2026-53289
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-11920
CVE-2026-11920 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.7.9. The vulnerability is a time-based SQL Injection in the query path that uses the user-supplied, insufficiently escaped parameters in the SQL statement, triggered when b...
CVE-2026-11920 JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...