WordPress plugin SQL注入漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. WordPress plugin is a WordPress application plugin. WordPress MOLIE plugin 0.5 and earlier versions have a SQL injection vulnerability, which stems from the failure of MOLIE to validate and escape SQL...

CVE-2021-24909

The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acfphotogallerymetaboxedit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24909: Improper Neutralization of Input During Web Page Generation

The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acfphotogallerymetaboxedit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue...

PT-2022-9503 · WordPress · Acf Photo Gallery Field

Name of the Vulnerable Software and Affected Versions: ACF Photo Gallery Field WordPress plugin versions prior to 1.7.5 Description: The issue arises from the lack of sanitization and escaping of the post parameter in the includes/acf photo gallery metabox edit.php file, leading to a Reflected...

Stars Rating < 3.5.1 - Comments Denial of Service

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated. Enable rating for a post/page, add a comment, capture the...

Sql injection

SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php...

CVE-2021-43451

SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php...

CVE-2021-43451: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php...

MOLIE <= 0.5 - Authenticated SQL Injection

The plugin does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection PoC https://example.com/wp-admin/post.php?post=validpostid+and+SLEEP%285%29=edit https://example.com/wp-admin/admin-post.php?action=edit=1+and+SLEEP%285%29...

CVE-2021-24889: Improper Neutralization of Special Elements used in an SQL Command

The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks...

PT-2021-16355

Name of the Vulnerable Software and Affected Versions: Ninja Forms Contact Form WordPress plugin versions prior to 3.6.4 Description: The issue allows high privilege users to perform SQL injection attacks due to the failure to escape keys of the fields POST parameter. Recommendations: For version...

VulnCheck KEV: CVE-2020-10221

rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter...

PT-2021-21382

Name of the Vulnerable Software and Affected Versions WordPress Ivory Search plugin versions = 4.6.6 Description A Reflected Cross-Site Scripting XSS issue exists, allowing potential exploitation through the &post parameter. Recommendations For WordPress Ivory Search plugin versions = 4.6.6, upda...

CVE-2021-24617: Improper Neutralization of Input During Web Page Generation

The GamePress WordPress plugin through 1.1.0 does not escape the opedit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues...

CVE-2021-42224

SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php...

CVE-2021-42224: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php...

Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection

Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection Vendor: Cypress Solutions Inc. Product web page: https://www.cypress.bc.ca Affected version: 2.7.1.5659 2.0.5.3356-184 Summary: CTM-200 is the industrial cellular wireless gateway for fixed and mobile applications. The CTM-200 is a...

CVE-2021-41322

Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process...

Default credentials

Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process...

PT-2021-23276 · Poly · Poly Vvx 400/410

Name of the Vulnerable Software and Affected Versions: Poly VVX 400/410 versions 5.3.1 and earlier Description: The issue allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process. Recommendations: For Poly VVX 400/410 versions...