PT-2023-19818 · WordPress · Active Directory Integration

Name of the Vulnerable Software and Affected Versions: Active Directory Integration plugin for WordPress versions up to and including 4.1.4 Description: The issue allows for time-based SQL Injection due to insufficient escaping on the user-supplied orderby and order parameters and lack of...

The vulnerability of the Permalink Manager Lite plugin for the WordPress content management system lies in its lack of protection against SQL query structures, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Permalink Manager Lite plugin for the WordPress content management system is related to the lack of protection for the SQL query structure when processing the orderby parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

CVE-2023-2608

The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projectslist function and insufficient escaping o...

CVE-2023-2608

The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projectslist function and insufficient escaping o...

novel-plus SQL注入漏洞

novel-plus novel-plus is a multi-end PC, WAP reading, well-functioning original literature CMS system. A security vulnerability exists in novel-plus version 3.6.2, which stems from a problem in the file DictController.java, where the operation of the parameter orderby can lead to sql injection...

PT-2023-17112 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: novel-plus version 3.6.2 Description: A critical issue affects some unknown functionality of the file DictController.java. The manipulation of the orderby argument leads to SQL injection. The attack can be launched remotely. Recommendations:...

CVE-2023-0254

The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges...

WordPress Plugin Simple Membership WP user Import SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Simple Membership WP user...

CVE-2022-2718

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2022-2717

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-events-form page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2022-2717

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-events-form page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2022-2718

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2022-2717

CVE-2022-2717 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.2.5. The vulnerability is an SQL Injection via the orderby parameter on the joomsport-events-form page, caused by insufficient escaping and an inadequately prepared SQL quer...

PT-2022-18265 · WordPress · Joomsport

Name of the Vulnerable Software and Affected Versions: JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress versions up to, and including, 5.2.5 Description: The issue is related to SQL Injection via the orderby parameter on the "joomsport-events-form" page. This...

PT-2022-18271 · WordPress · Joomsport – For Sports: Team & League

Name of the Vulnerable Software and Affected Versions: JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress versions up to, and including, 5.2.5 Description: The issue allows authenticated attackers with administrative privileges to perform SQL Injection via the...

CVE-2022-36605

Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter...

Yimioa SQL注入漏洞

Yimioa is the collaborative office software of Cloud.com Software. Based on enterprise-class workflow engine, in-depth research and development for 15 years, served more than 1000 customers, based on springboot framework. With mature OA office functions, comes with a low-code development platform...

WordPress Five Minute Webshop plugin SQL injection vulnerability (CNVD-2022-64660)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. The WordPress Five Minute Webshop plugin 1.3.2 and earlier versions are vulnerable to SQL injection, whic...

CVE-2022-1685

The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection...

CVE-2022-1685

The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection...