EUVD-2021-11258

Malware in sbrugna...

EUVD-2008-6892

Malware in sbrugna...

CVE-2021-24345

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

WordPress Sendit WP Newsletter plugin SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Sendit WP Newsletter plugin 2.5.1 and earlier...

CVE-2021-24345

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

CVE-2021-24345

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

CVE-2021-24345

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

Sql injection

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

CVE-2021-24345 Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

CVE-2021-24345

The CVE-2021-24345 entry describes a SQL Injection in the Sendit WP Newsletter WordPress plugin (versions ≤ 2.5.1) that is exploitable by an Administrator user via the id_lista POST parameter in the lists-management feature. The underlying issue is lack of sanitization/escaping of id_lista before...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Sendit WP Newsletter plugin 2.5.1 and earlier...

CVE-2021-24345: Improper Neutralization of Special Elements used in an SQL Command

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection...

WordPress Sendit WP Newsletter plugin <= 2.5.1 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Sendit WP Newsletter plugin versions = 2.5.1. Solution This plugin has been closed as of April 29, 2021 and is not available for download. This closure is temporary, pending a full review...

Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection

The page lists-management feature of the plugin, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection. PoC time curl -i -s -k -X $'POST' \ -H $'Upgrade-Insecure-Requests: 1' -H...

Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection

The page lists-management feature of the plugin, available to Administrator users does not sanitise, validate or escape the idlista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection. time curl -i -s -k -X $'POST' \ -H $'Upgrade-Insecure-Requests: 1' -H...

WordPress SendIt Plugin <= 2.1.0 - SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands via "id" parameter. Solution Upgrade the plugin...

Sendit < 2.1.1 - SQL Injection

The Sendit WP Newsletter WordPress plugin was affected by a SQL Injection security vulnerability...

SendIt <= 1.5.9 - Blind SQL Injection

The Sendit WP Newsletter WordPress plugin was affected by a Blind SQL Injection security vulnerability...

WordPress SendIt plugin <= 1.5.9 - Blind SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress SendIt plugin = 1.5.9 Blind SQL Injection Vulnerability Google Dork: inurl:wp-content/plugins/sendit/submit.php Date: 2011-08-25 Author: evilsocket evilsocket at gmail dot com Software Link: http://wordpress.org/extend/plugins/sendit/...

WordPress SendIt 1.5.9 Blind SQL Injection

Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using $usercount for the boolean condition checking :...