CVE-2022-0846

The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users...

Sql injection

The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users...

CVE-2022-0846

CVE-2022-0846 affects the WordPress plugin SpeakOut! Email Petitions up to version 2.14.15.1. The vulnerability is due to improper sanitisation/escaping of the id parameter used in the SQL statement within the dk_speakout_sendmail AJAX action, allowing unauthenticated SQL injection. Exploitation ...

CVE-2022-0846 SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi

The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users...

SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi

The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users Create a new email petition /wp-admin/admin.php?page=dkspeakoutaddnew, check x Do not send email onl...

WordPress SpeakOut! Email Petitions plugin <= 2.14.14 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress SpeakOut! Email Petitions plugin versions = 2.14.14. Solution Update the WordPress SpeakOut! Email Petitions plugin to the latest available version at least 2.14.15.1...

SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi

The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users PoC Create a new email petition /wp-admin/admin.php?page=dkspeakoutaddnew, check x Do not send email...

SpeakOut! Email Petitions < 2.13.3 - Reflected Cross-Site Scripting

The plugin does not escape its searchString parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=dkspeakoutsignatures=search="...

SpeakOut! Email Petitions < 2.13.3 - Reflected Cross-Site Scripting

The plugin does not escape its searchString parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/admin.php?page=dkspeakoutsignatures&action=search&searchString="alert/XSS/...

WordPress SpeakOut! Email Petitions plugin <= 2.13.1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress SpeakOut! Email Petitions plugin versions = 2.13.1.1. Solution Update the WordPress SpeakOut! Email Petitions plugin to the latest available version at least 2.13.3...

Drupal Petition module cross-site scripting vulnerability (CNVD-2015-03892)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Petitions is one of the petition modules used in the U.S. White House website. A cross-site scripting vulnerability exists in the administration page of the Drupal Petitions module. A...

SA-CONTRIB-2014-060- Petitions - Cross Site Request Forgery (CSRF)

This distribution enables you to build an application that lets users create and sign petitions. The contained whpetitions module doesn't sufficiently verify the intent of the user when signing a petition. A malicious user could trick another user into signing a petition they did not intend to si...

CVE-2006-0517

Multiple SQL injection vulnerabilities in formulaires/inc-formulaireforum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 idforum, 2 idarticle, or 3 idbreve parameters to forum.php3; 4 unspecified vectors related...

DEBIAN-CVE-2006-0517

Multiple SQL injection vulnerabilities in formulaires/inc-formulaireforum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 idforum, 2 idarticle, or 3 idbreve parameters to forum.php3; 4 unspecified vectors related...

CVE-2006-0517

Multiple SQL injection vulnerabilities in formulaires/inc-formulaireforum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 idforum, 2 idarticle, or 3 idbreve parameters to forum.php3; 4 unspecified vectors related...

CVE-2006-0517

Multiple SQL injection vulnerabilities in formulaires/inc-formulaireforum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 5539 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 idforum, 2 idarticle, or 3 idbreve parameters to forum.php3; 4 unspecified vectors related...