12397 matches found
CVE-2019-15658
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...
CVE-2019-15658
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...
Sql injection
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...
CVE-2019-15658
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...
CVE-2019-15658
The CVE-2019-15658 entry concerns the npm package connect-pg-simple (PostgreSQL session store). Affected versions prior to 6.0.1 are vulnerable to SQL injection when tableName or schemaName are untrusted inputs. The root cause is in PGStore.prototype.quotedTable, which uses those variables to bui...
GHSA-XQH8-5J36-4556 SQL Injection in connect-pg-simple
Impact An unlikely SQL injection if the case of an unsanitized table name input. Patches The user should upgrade to 6.0.1. Due to its low impact a backport has not been made to the 5.x branch. Workarounds If there is no likelihood that the tableName or schemaName options sent to the constructor...
CVE-2017-18573
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection...
Sql injection
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection...
CVE-2017-18573
The CVE-2017-18573 entry concerns the WordPress plugin simple-login-log, vulnerable to SQL injection in versions before 1.1.2. The issue’s root cause is improper handling of SQL queries in the login-logging functionality, enabling an attacker to inject SQL commands. Several connected records (Red...
WordPress simple-membership plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. simple-membership plugin is a website membership plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...
WordPress simple-login-log plugin SQL injection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. simple-login-log is a user login logging plugin used in it. A SQL injection vulnerability exists in the WordPress simple-login-log...
WordPress simple-fields plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. simple-fields is a custom fields plugin used in it. WordPress simple-fields plug-in exists piece of cross-site request forgery...
CVE-2013-7476
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface...
CVE-2016-10884
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues...
CVE-2013-7476
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface...
CVE-2013-7476
The connected advisories confirm a CSRF vulnerability in the WordPress Simple Fields plugin prior to version 1.2, affecting the admin interface. Root cause: CSRF in admin actions could allow unauthorized requests when an authenticated admin visits a malicious page. Impact is described in CVE reco...
CVE-2016-10884
CVE-2016-10884 affects the WordPress Simple Membership plugin prior to 3.3.3, with multiple CSRF vulnerabilities. The Red Hat, CVE databases and WP vulnerability feeds consistently describe CSRF flaws in this plugin version. The root cause is improper CSRF protection allowing unauthorized state-c...
CVE-2016-10884
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues...