CVE-2024-43965

CVE-2024-43965 SendGrid for WordPress = 1.4 - Inyección SQL no autenticada Descripción El plugin SendGrid for WordPress para WordPress es vulnerable a Inyección SQL en las versiones hasta la 1.4, inclusive, debido a un escape insuficiente del parámetro proporcionado por el usuario y a la falta de...

CVE-2024-37843-POC

CVE-2024-37843-POC PoC para CVE-2024-37843. Inyección SQL ciega basada en tiempo en Craft CMS Detalles disponibles en blog PoC curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \ \n \n LIMIT 5 AS subquery\nINNER...

CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - Inyección SQL no autenticada a través del parámetro orderby Descripción El plugin Events Manager – Calendar, Bookings, Tickets, and more! para WordPress es vulnerable a una inyección SQL basada en tiempo a través del parámetro 'orderby' en todas las versione...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538 LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-91895

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.4.7 ) is vulnerable to Reflected DOM-Based Cross-Site Scripting . The flaw exists in the 'orderby' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbit...

CVE-2026-97634

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-97634 Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2026-91256

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-97634

The Event Tickets and Registration plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 5.29.5 . The root cause is insufficient escaping of the user-supplied orderby parameter and a lack of sufficient preparation on the existing SQL query. This allows ...

PT-2026-104151

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2025-58789

Sink: The getOrderParameters function leads to SQL Injection vulnerability in the $orderBy and $order variables. PoC...

CVE-2021-43789

CVE-2021-43789 Prestashop = 1.7.5.0 1.7.8.2 - SQL injection POC GET /prestashop1.7.8.1/admin860ykaqhn/index.php/sell/orders/?token=tPhFxoTyY8HLoCWbfVDKdY8Io1BVL3ZVebYNljeM9M&orderorderBy=idorder&ordersortOrder= AND SELECT 2331 FROMSELECT COUNT,CONCAT0,MIDIFNULLCASTCURRENTUSER AS...

CVE-2026-94143

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...

CVE-2026-94143

Drogon (C++ web framework) up to 1.9.13 is affected by a SQL injection in the ORM Mapper component, specifically in the Mapper::orderBy function within Mapper.h. Manipulating the sort argument allows a remote, unauthenticated attacker to inject SQL. A public proof-of-concept exploit is available....

CVE-2026-94143 drogonframework drogon ORM Mapper Mapper.h orderBy sql injection

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...

EUVD-2026-83836

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...

CVE-2026-94143 drogonframework drogon ORM Mapper Mapper.h orderBy sql injection

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...

CVE-2026-94143 drogonframework drogon ORM Mapper Mapper.h orderBy sql injection

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...