CVE-2026-107803

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

EUVD-2026-95777

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2026-107803

The open-source workflow management software ProcessMaker is vulnerable to SQL injection in the GET /api/1.0/tasks endpoint prior to version 2026.14.3 . The root cause is located in ProcessMaker raits askcontrollerindexmethods::applycolumnordering(), where the application concatenates a user-cont...

CVE-2026-107803 ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2021-35042

CVE-2021-35042 حقن SQL عبر إدخال QuerySet.orderby غير المعقم الإعداد: قم بتشغيل ./setup.sh للإعداد الأولي افتح صورة docker لبدء قاعدة البيانات: docker exec -it containerid /bin/bash وقم بتشغيل الأوامر التالية: python manage.py makemigrations cve202135042 python manage.py migrate ابدأ الحالات...

CVE-2026-79303

CVE-2026-79303 حقن SQL أعمى Boolean-blind SQL injection الوصف : يتم إنشاء عبارات SQL ديناميكية دون التحقق المطلوب من البيانات ودون استخدام عبارات مُعلمة أو إجراءات مخزنة. الأثر : SQLi متجه CVSSv3.1 : AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 9.9 حرج CWE : CWE-89: تحييد غير صحيح للعناصر الخاصة المستخدمة...

CVE-2021-35042

CVE-2021-35042 : Vulnérabilité d'injection SQL dans Django I. Aperçu général Django est un framework de développement d'applications web open source, écrit en Python et construit selon le modèle MVC Model - View - Controller. Il a été initialement conçu pour gérer les sites web de contenu...

CVE-2026-1312

CVE-2026-1312 هو ثغرة أمنية عالية الخطورة من نوع حقن SQL في Django: عند استخدام أسماء أعمدة مستعارة تحتوي على نقاط في QuerySet.orderby، مع استخدام FilteredRelation لبناء الاستعلام ديناميكيًا عبر توسيع قاموس، قد يتمكن المهاجم من حقن SQL خبيث الإصدارات المتأثرة: إصدارات فرع Django 6.0 قبل 6.0.2...

CVE-2023-6567-poc

CVE-2023-6567-poc SQL-инъекция на основе времени Описание Плагин не выполняет должную санитизацию и экранирование параметра orderby перед использованием его в SQL-запросе, что приводит к SQL-инъекции, эксплуатируемой неаутентифицированными пользователями 1. Уязвимый GET-запрос:...

CVE-2025-56381

CVE-2025-56381 — Injection SQL authentifiée dans ERPNext / Frappe via les paramètres orderby et groupby 📌 Résumé ERPNext v15.67.0 et Frappe Framework v15.72.4 contiennent plusieurs vulnérabilités d'injection SQL authentifiées dans le point de terminaison API frappe.desk.reportview.get. Une entrée...

CVE-2022-45808

CVE-2022-45808 إضافة LearnPress = 5.0.12 AND time-based blind que...

CVE-2021-35042

CVE-2021-35042 QuerySet.orderby अविश्वसनीय इनपुट के माध्यम से SQL इंजेक्शन सेटअप: इन्स्टेंस शुरू करने के लिए उपयोग करें: docker-compose up अब नमूना डेटा लोड करने के लिए निम्नलिखित URL खोलें: http://localhost:8000/vulapp/setup फिर कमजोर पृष्ठ पर जाएं: http://localhost:8000/vulapp/ पैरामीटर का शोषण...

CVE-2021-35042

CVE-2021-35042 ثغرة حقن SQL في Django السؤال: استكشف مدى قابلية استغلالها؟ الجواب: أنا مرعوب التثبيت poetry install poetry run ./manage.py migrate poetry run ./manage.py loaddata dummydata.json عرض تفاعلي poetry run ./manage.py runserver الفرز حسب حقول عشوائية انتقل إلى...

CVE-2025-50383

CVE-2025-50383 विवरण एक निम्न-विशेषाधिकार प्रमाणित उपयोगकर्ता इस भेद्यता का शोषण कर सकता है, एक दुर्भावनापूर्ण orderby पैरामीटर जैसे, orderby=IF1=1,SLEEP5,1 के साथ एक क्राफ्टेड HTTP POST अनुरोध भेजकर। इससे समय-आधारित ब्लाइंड SQL इंजेक्शन ट्रिगर हो सकता है, जिसके परिणामस्वरूप अंतर्निहित MySQL...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection in versions up to and including 5.0.18 . The flaw exists in the order_by parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint. The root cause is the direct concatenation of user-supplied input i...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-91246

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951: Improper Neutralization of Special Elements used in an SQL Command

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...