537 matches found
CVE-2025-28198
A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component...
CVE-2025-28198: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component...
CVE-2025-28198
A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component...
CVE-2025-28198
A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component...
CVE-2025-3559
A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The...
PT-2025-15412 · WordPress · Coreactivity
Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging plugin for WordPress versions prior to 2.8 Description: The issue arises from insufficient escaping of user-supplied parameters order and orderby, and a lack of proper preparation of existing SQL queries. This...
FastCMS 安全漏洞
FastCMS is a content management system from FastCMS Inc. A security vulnerability exists in FastCMS 0.1.5 and earlier versions, which stems from improper manipulation of the orderBy parameter in the /api/client/article/list file, which could lead to a SQL injection attack...
CVE-2025-2250: Improper Neutralization of Special Elements used in an SQL Command
The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient...
WordPress plugin WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins SQL注入漏洞
WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin WordPress Report Brute Force Attacks and Login Protection...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
WordPress plugin Multilevel Referral Affiliate Plugin for WooCommerce SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...
CVE-2024-13750: Improper Neutralization of Special Elements used in an SQL Command
The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
GFast 安全漏洞
GFast is a GF Go Frame based backend management system by tiger1103. A security vulnerability exists in GFast v2 to v3.2, which originates from a SQL injection in the OrderBy parameter of /system/operLog/list...
CVE-2024-55160
The GFast backend management system (a GF-based system by tiger1103) is vulnerable to a SQL injection in versions v2 through v3.2 . The root cause is the improper neutralization of special elements in the OrderBy parameter located at the /system/operLog/list API endpoint. This vulnerability could...
CVE-2024-55160: Improper Neutralization of Special Elements used in an SQL Command
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
CVE-2024-55160
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list...
PT-2025-9017
Name of the Vulnerable Software and Affected Versions GFast versions v2 through v3.2 Description A SQL injection issue was found via the OrderBy parameter at the "/system/operLog/list" API endpoint. Recommendations For GFast versions v2 through v3.2, avoid using the OrderBy parameter in the...