513 matches found
CVE-2025-28198
A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component...
CVE-2025-3559
A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The...
PT-2025-15412 · WordPress · Coreactivity
Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging plugin for WordPress versions prior to 2.8 Description: The issue arises from insufficient escaping of user-supplied parameters order and orderby, and a lack of proper preparation of existing SQL queries. This...
FastCMS 安全漏洞
FastCMS is a content management system from FastCMS Inc. A security vulnerability exists in FastCMS 0.1.5 and earlier versions, which stems from improper manipulation of the orderBy parameter in the /api/client/article/list file, which could lead to a SQL injection attack...
WordPress plugin WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins SQL注入漏洞
WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin WordPress Report Brute Force Attacks and Login Protection...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
WordPress plugin Multilevel Referral Affiliate Plugin for WooCommerce SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
CVE-2024-55160
GFast (Go Frame-based backend, v2–v3.2) contains a SQL injection vulnerability in the OrderBy parameter used by /system/operLog/list. Root cause: improper handling/validation of the OrderBy value allows attackers to inject SQL, enabling unauthorized access or data leakage. CVSS v3.1 metrics indic...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
GFast 安全漏洞
GFast is a GF Go Frame based backend management system by tiger1103. A security vulnerability exists in GFast v2 to v3.2, which originates from a SQL injection in the OrderBy parameter of /system/operLog/list...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
CVE-2024-13500
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied...
CVE-2024-13500 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied...
CVE-2024-13500 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied...
WordPress plugin WP Project Manager SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...
WordPress WP Project Manager plugin <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter vulnerability
Authenticated Subscriber+ SQL Injection via orderby Parameter vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Project Manager versions = 2.6.17...
CVE-2024-4743
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlmsfavorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...