5844 matches found
PT-2025-44736
Name of the Vulnerable Software and Affected Versions SourceCodester Best House Rental Management System version 1.0 Description A flaw exists in the software that allows for SQL injection. The issue is located in the save tenant function within the /admin class.php file. Manipulation of the...
SourceCodester Best House Rental Management System SQL注入漏洞
SourceCodester Best House Rental Management System is a SourceCodester open source house rental management system. SourceCodester Best House Rental Management System version 1.0 exists SQL injection vulnerability, the vulnerability stems from the file /adminclass.php function savetenant on the...
CVE-2025-11975
The FuseWP – WordPress User Sync to Email List & Marketing Automation Mailchimp, Constant Contact, ActiveCampaign etc. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savechanges function in all versions up to, and including,...
CVE-2025-7846
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savefields function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
CVE-2025-7846 WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savefields function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
EUVD-2025-37305
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savefields function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
PT-2025-44583
Name of the Vulnerable Software and Affected Versions WordPress User Extra Fields versions up to and including 16.7 Description The WordPress User Extra Fields plugin is susceptible to arbitrary file deletion. This is due to inadequate file path validation within the save fields function...
PT-2025-44578
Name of the Vulnerable Software and Affected Versions FuseWP – WordPress User Sync to Email List & Marketing Automation Mailchimp, Constant Contact, ActiveCampaign etc. plugin versions through 1.1.23.0 Description The FuseWP plugin for WordPress has a flaw that allows unauthorized modification of...
WordPress plugin FuseWP 安全漏洞
WordPress FuseWP plugin is a WordPress plugin for creating and managing multilingual websites. WordPress FuseWP plugin suffers from an unauthorized modification of data vulnerability that stems from a lack of capability check in the savechanges function, which can be exploited by an attacker to a...
WordPress plugin User Extra Fields 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability...
Exploit for CVE-2025-6440
Description WooCommerce Designer Pro plugin for WordPress c...
CVE-2025-60542
A flaw was found in TypeORM. When used with MySQL/mysql2 drivers, the repository.save or repository.update methods incorrectly handle nested JSON objects. This is due to an underlying setting stringifyObjects: false that allows an attacker to craft a malicious JSON payload and cause a SQL injecti...
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
Summary SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. Details Vulnerable Code: js const username, city, name = req.body; const updateData = username, city, name,...
EUVD-2025-36689
SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false...
GHSA-Q2PJ-6V73-8RGJ TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
Summary SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. Details Vulnerable Code: js const username, city, name = req.body; const updateData = username, city, name,...
SQL Injection
Overview typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript ES5, ES6, ES7, ES8. Affected versions of this package are vulnerable to SQL Injection via the repository.sa...
CVE-2025-60542
SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false...
PT-2025-44304
Name of the Vulnerable Software and Affected Versions TypeORM versions prior to 0.3.26 Description A SQL Injection issue exists in TypeORM. This is due to the sqlstring call using stringifyObjects set to false when processing requests to repository.save or repository.update. A crafted request can...
