WordPress WooCommerce Lottery plugin <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters vulnerability

Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters vulnerability discovered by h0xilo in WordPress Plugin WooCommerce Lottery versions = 2.2.9...

CVE-2026-18884

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

EUVD-2026-66333

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

CVE-2026-18884 WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

CVE-2026-18884

The WooCommerce Lottery plugin for WordPress (all versions up to and including 2.2.9 ) is vulnerable to unauthenticated time-based SQL injection via the orderby and order GET parameters. The root cause is insufficient escaping on user-supplied input combined with inadequate preparation of the exi...

CVE-2024-37843-POC

CVE-2024-37843-POC POC per CVE-2024-37843. Blind SQLi basata sul tempo in Craft CMS Dettagli disponibili nel blog POC root@kitploit: curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS...

CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - SQL Injection non autenticata tramite parametro orderby Descrizione Il plugin Events Manager – Calendar, Bookings, Tickets, and more! per WordPress è vulnerabile a SQL Injection basata sul tempo attraverso il parametro 'orderby' in tutte le versioni fino all...

CVE-2024-43965

CVE-2024-43965 SendGrid per WordPress = 1.4 - SQL Injection non autenticata Descrizione Il plugin SendGrid per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 1.4 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di una preparazione...

CVE-2026-76785 amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to...

WordPress affiliate-toolkit plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin affiliate-toolkit versions = 3.8.8...

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12743

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-58590

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-11920

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-11920

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

EUVD-2026-53289

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-11920

CVE-2026-11920 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.7.9. The vulnerability is a time-based SQL Injection in the query path that uses the user-supplied, insufficiently escaped parameters in the SQL statement, triggered when b...