CVE-2021-24465

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned...

POC-EXP

It is an offensive tool for vulnerability exploitation. The repository contains a collection of exploits and proof-of-concept PoC code for various vulnerabilities. No specific CVE or GHSA IDs are mentioned, but the repository is likely focused on demonstrating exploitation techniques rather than...

CVE-2020-20692

GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $GET parameter in /src/core/controllers/cm.php...

OS4Ed OpenSIS SQL注入漏洞

openSIS is a free and open source student information system/school management software. openSIS version 8.0 has a SQL injection vulnerability in the cpidmissattn parameter in TakeAttendance.php. An attacker can exploit this vulnerability to inject SQL queries...

SAP Business One SQL注入漏洞

SAP Business One is a suite of enterprise management software from SAP, a German company. SAP Business One version 10.0 has a SQL injection vulnerability that stems from the lack of effective validation and escaping of SQL statements, which can be exploited by an attacker with business privileges...

S-CMS SQL注入漏洞

S-CMS is a product developed by Zibo Shining Network Technology Co., Ltd. that provides solutions for building enterprise websites. a SQL injection vulnerability exists in the 4.edu.phpconnfunction.php component of S-CMS version 1.0. An attacker can use this vulnerability to access sensitive...

CVE-2021-38390

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...

YouDianCMS SQL注入漏洞

YouDianCMS is a web CMS. version 8.0 of YouDianCMS is vulnerable to SQL injection, which stems from a lack of search keyword filtering in the search bar and can be exploited to obtain sensitive database information...

thinkphp-zcms SQL注入漏洞

thinkphp-zcms is open source based on thinkphp3.2 development of a cms system , more comprehensive features . thinkphp-zcms There is a SQL injection vulnerability , an attacker can use the vulnerability through index.php?m=home&c=message&a=add to execute arbitrary SQL commands...

Delta Electronics DIAEnergie SQL注入漏洞

A SQL blind injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint in DIAEnergie 1.7.5 and earlier versions. The vulnerability stems from the application not properly validating the value provided by the user via the parameter agid before using the value as part of a S...

Delta Electronics DIAEnergie SQL注入漏洞

A SQL blind injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint in DIAEnergie 1.7.5 and earlier versions. The vulnerability stems from the application not properly validating the value provided by the user via the parameter egyid before using the value as part of a...

CVE-2021-24550

The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue...

CVE-2021-35458

Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php aka p=products via the c or s parameter...

CVE-2020-21806

SQL Injection Vulnerability in ECTouch v2 via the shop page in index.php...

ECTouch SQL注入漏洞

ECTouch is a software application. An open source mobile mall system to create an enterprise exclusive mobile mall. A SQL injection vulnerability exists in ECTouch, which originates from the product index.php page failing to filter the input of special characters, an attacker can execute illegal...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Woocommerce. The vulnerability stems from a lack o...

CVE-2021-26226

SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edituser.php...

CASAP Automated Enrollment SQL注入漏洞

CASAP Automated Enrollment is an automated enrollment system for the CASAP organization. The goal of this project is to provide CASAP with an automated enrollment system to streamline the school's processes and make them more effective, efficient and easily retrievable. SourceCodester Alumni...

Vulnerabilities fixed in Kaseya Virtual System Administrator (VSA)

Vulnerabilities have been fixed in Kaseya VSA. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Bypassing authentication Remote code execution Administrator/Root rights SQL Injection Access to sensitive data...

Metinfo MetInfo SQL注入漏洞

Metinfo MetInfo is a content management system CMS developed by China Metinfo using PHP and Mysql. A SQL injection vulnerability exists in MetInfo, which originates from the product's admin/?n=language&c=languageweb&a=doAddLanguage does not securely validate user input data, and can be exploited ...