CVE-2026-9767: Improper Neutralization of Special Elements used in an SQL Command

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-13009: Improper Neutralization of Special Elements used in an SQL Command

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

PT-2023-2929 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo versions prior to 13.6.0 Description: The issue is related to a lack of validation of XML object sequences in the user list backend.php script of the Piwigo content management system. This can be exploited by a remote attacker to condu...

CVE-2023-27233: Improper Neutralization of Special Elements used in an SQL Command

Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order0dir parameter at userlistbackend.php...

CVE-2023-27233

Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order0dir parameter at userlistbackend.php...

CVE-2021-24747: Improper Neutralization of Special Elements used in an SQL Command

The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fnmyajaxifieddataloaderajax" AJAX request as the $REQUEST'order'0'dir' parameter is not properly escaped leading to blind and error-based SQL injections...

CVE-2021-32615

Piwigo 11.4.0 allows admin/userlistbackend.php order0dir SQL Injection...

PT-2021-19808

Name of the Vulnerable Software and Affected Versions Piwigo version 11.4.0 Description The issue allows for SQL Injection through the order0dir parameter in the admin/user list backend.php endpoint. Recommendations For Piwigo version 11.4.0, as a temporary workaround, consider restricting access...

CVE-2021-32615: Improper Neutralization of Special Elements used in an SQL Command

Piwigo 11.4.0 allows admin/userlistbackend.php order0dir SQL Injection...

PT-2021-17125

Name of the Vulnerable Software and Affected Versions wpDataTables versions prior to 3.4.1 Description The issue is related to how wpDataTables handles order direction for server-side tables, leading to a SQL injection. This can be exploited through the "admin-ajax.php?action=get wdtable" endpoin...

CVE-2021-26754: Improper Neutralization of Special Elements used in an SQL Command

wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=getwdtable order0dir SQL injection...

CVE-2020-15884

A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order0dir field on POST requests to /datatables/data...

PT-2020-14685

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 5.6.3 Description A SQL injection issue allows attackers to execute arbitrary SQL commands. This is achieved via the order0dir field on POST requests to the "/datatables/data" API endpoint. Recommendations For...

CVE-2020-15884: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order0dir field on POST requests to /datatables/data...

CVE-2019-13076: Improper Neutralization of Special Elements used in an SQL Command

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

CVE-2019-12918: Improper Neutralization of Special Elements used in an SQL Command

Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is softwarelibrary.php and affected parameters are order0column and order0dir...

PT-2019-13020

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317 Description The issue concerns a SQL injection problem. The affected file is software library.php, and the vulnerable parameters are order0column and order0dir...

PT-2019-13111

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317 Description The issue allows an authenticated user to execute arbitrary commands against the database due to SQL injection. The affected component is "/userui/ticket...