CVE-2024-30486

CVE-2024-30486 is an authenticated SQL injection in the WordPress plugin Media Library Folders (Media Library Folders: 8.1.7 and earlier). The issue arises from improper neutralization of input in SQL commands, enabling an attacker with Author+ or higher permissions to manipulate queries. The vul...

CVE-2024-30499: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4...

CVE-2024-23538: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Fineract.This issue affects Apache Fineract: 1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue...

CVE-2023-39309

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1...

CVE-2024-29239

Summary (CVE-2024-29239) : A SQL injection vulnerability exists in the Recording.CountByCategory webapi component of Synology Surveillance Station prior to 9.2.0-11289 and 9.2.0-9289. The issue stems from improper neutralization of special elements in SQL commands, enabling remote authenticated u...

CVE-2024-29236

Synology Surveillance Station is affected by CVE-2024-29236 due to an SQL injection vulnerability in the AudioPattern.Delete webapi component. The flaw arises from improper neutralization of special elements used in SQL commands, enabling remote authenticated users to read the database and cause ...

CVE-2024-29230

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in SnapShot.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information...

CVE-2024-30241

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.1...

CVE-2024-30236

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through = 21.3.4...

CVE-2024-30241

CVE-2024-30241 is an SQL Injection in ProfileGrid (WordPress plugin) affecting ProfileGrid versions through 5.7.1. Exploitation requires at least Contributor+ access (authenticated). A fix is available in 5.7.2 (and later); update to a patched release to mitigate. Other connected sources corrobor...

CVE-2024-30243

CVE-2024-30243 is an SQL Injection affecting the WordPress Tooltips plugin prior to 9.4.5, caused by improper neutralization of SQL elements. The metric indicates a base CVSS v3.1 score of 8.5 (HIGH) with network attack vector, low attack complexity, and user interaction NONE. Affected software: ...

CVE-2024-30244

The Church Admin WordPress plugin (andy_moyle church-admin) is vulnerable to SQL Injection in versions 4.0.27 and earlier . The root cause is the improper neutralization of special elements used in SQL commands, specifically allowing for the injection of malicious SQL code. A practical consequenc...

CVE-2024-30238

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through = 21.3.2...

CVE-2024-30238

CVE-2024-30238 affects the WordPress Photos and Files Contest Gallery plugin (

ROS-20240322-02

Vulnerability of REFRESH MATERIALIZED VIEW CONCURRENTLY function of PostgreSQL database management system is related to privilege management errors in processing and checking command line parameters. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary SQ...

CVE-2024-27956: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0...

CVE-2024-25937: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the script DIAEtagHandler.ashx...

BIT-POSTGRESQL-2020-14349

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the searchpath during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the...

PT-2024-20275 · Unknown · Crmeb Java

Name of the Vulnerable Software and Affected Versions: crmeb java versions prior to 1.3.4 Description: The issue allows attackers to execute arbitrary SQL commands by sending a crafted GET request to the "api/front/spread/people" endpoint. This enables attackers to manipulate the database,...

CVE-2024-25927

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Joel Starnes postMash – custom post order.This issue affects postMash – custom post order: from n/a through 1.2.0...