WordPress plugin WP Project Manager SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress WP Project Manager plugin <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter vulnerability

Authenticated Subscriber+ SQL Injection via orderby Parameter vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Project Manager versions = 2.6.17...

CVE-2024-4743

The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlmsfavorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-57437

RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list...

CVE-2024-57437

RuoYi (software) v4.8.0 contains a SQL injection vulnerability in the /monitor/online/list endpoint, exploitable via the orderby parameter. The CVE-2024-57437 entry lists a CVSS v3.1 base score of 6.5 (MEDIUM) with Network attack vector, low attack complexity, and privileges required. The impact ...

CVE-2024-57437

RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list...

CVE-2024-13496

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and la...

CVE-2024-13496 GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and la...

WordPress plugin GamiPress SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

CVE-2024-11722

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2024-17211 · Dynamiapps · The Frontend Admin

Name of the Vulnerable Software and Affected Versions: The Frontend Admin by DynamiApps plugin for WordPress versions up to, and including, 3.25.1 Description: The issue allows unauthenticated attackers to perform SQL Injection via the orderby parameter due to insufficient escaping on the...

WordPress plugin Frontend Admin by DynamiApps SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

CVE-2024-12015

The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route...

CVE-2024-12015

CVE-2024-12015 : Authenticated SQL Injection in the WP Project Manager plugin via the orderby parameter on the /pm/v2/activites endpoint. Exploitation requires valid credentials; no patch status details are provided in the connected documents, and the vulnerability is listed as unpatched in Wordf...

CVE-2024-12015 SQL Injection in WordPress Project Manager Plugin

The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route...

WordPress plugin Project Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the...

PT-2024-17402 · WordPress · Project Manager

Name of the Vulnerable Software and Affected Versions: Project Manager WordPress Plugin affected versions not specified Description: The issue is an authenticated SQL injection vulnerability in the orderby parameter in the "/pm/v2/activites" API endpoint. This vulnerability affects the 'Project...

CVE-2024-49203

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...

CVE-2024-49203

Summary: CVE-2024-49203 affects Querydsl 5.1.0 and OpenFeign Querydsl 6.8, enabling SQL/HQL injection in the orderBy path of JPAQuery. The issue arises from how untrusted input can influence the OrderSpecifier/orThe orderBy clause, potentially allowing information leakage or denial of service. Re...

PT-2024-38366 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version v1.4.2 Description: A SQL injection vulnerability exists in the "/api/v1/external-users" route. The order by clause of the SQL query uses sql.unsafe without prior sanitization, allowing for SQL injection. The...