545 matches found
CVE-2024-8855
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks...
CVE-2024-8855 WordPress Auction <= 3.7 - Editor+ SQL Injection
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks...
WordPress plugin WordPress Auction Plugin 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2024-11356
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks...
CVE-2024-11846
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-11846
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-11846
CVE-2024-11846 Travel Tour faces a reflected XSS due to improper sanitization/escaping of a parameter in Travel Tour before output. Affected software: Travel Tour (WordPress plugin) versions prior to 5.2.4. Impact is Reflected XSS potentially exploitable by attackers to run script in context of a...
CVE-2024-11846 Travel Tour < 5.2.4 - Reflected XSS
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PT-2025-37303
Name of the Vulnerable Software and Affected Versions: Zabbix Agent 2 affected versions not specified Description: The Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, which allows an attacker to inject unexpected arguments into the smartctl command. This can b...
Script Injection
Debezium is vulnerable to script injection. The vulnerability is due to improper sanitization of parameters, allowing attackers to perform a script injection attack that may result in unauthorized data exposure...
PT-2024-16319 · WordPress · Ai Engine
Name of the Vulnerable Software and Affected Versions: AI Engine WordPress plugin versions prior to 2.6.5 Description: The issue concerns a failure to properly sanitize and escape a parameter from one of the plugin's RESP API endpoints before using it in a SQL statement. This allows administrator...
PT-2024-35766 · Siyuan · Siyuan
Name of the Vulnerable Software and Affected Versions: Siyuan version 3.1.11 Description: A SQL injection issue has been identified in Siyuan via the ids array parameter in the "/batchGetBlockAttrs" API endpoint. This allows for potential exploitation. Recommendations: For Siyuan version 3.1.11, ...
CVE-2024-50360
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The source of the vulnerability relies on...
CVE-2023-1419
A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data...
CVE-2024-41714
A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 9.8.1.5 and MiVoice Business Solution Virtual Instance MiVB SVI through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful...
CVE-2024-35285
A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization...
CVE-2024-35314
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance MiVB SVI 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user...
CVE-2024-35314
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance MiVB SVI 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user...
CVE-2024-35285
A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization...