WordPress Vitepos – Point of Sale (POS) for WooCommerce plugin <= 3.6.1 - Authenticated (Vendor+) SQL Injection vulnerability

Authenticated Vendor+ SQL Injection vulnerability discovered by John Ryan Albon in WordPress Plugin Vitepos versions = 3.6.1...

owasp-top10-exploitation

Manual Validation with Burp Suite Automated scanners SAST, D...

WHEELS.DEV: Wheels SQL injection vulnerability

WHEELS.DEV: Versions of Wheels 4.1.2 and earlier have an SQL injection vulnerability. This vulnerability occurs in MySQL/MariaDB environments where escape characters are enabled. When the application provides request data to inline literal paths, it does not consider escape characters and simply...

Frappe HR SQL Injection Vulnerability

Versions of Frappe before 14.38.2, as well as versions before 14.x before 15.64.0, 15.x before 16.18.0, and 16.x before 16.18.0 have a SQL injection vulnerability. This vulnerability stems from the lack of input validation on certain endpoints, which may lead to SQL injections. Any authenticated...

WordPress Mail Mint SQL Injection Vulnerability

WordPress Mail Mint 1.31.4 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper handling of the filters parameter in the /wp-json/mrm/v1/segments/contacts REST endpoint. The value of the filter parameter provided by users is insufficiently escaped. In li...

WordPress MapSVG SQL Injection Vulnerability

WordPress MapSVG versions 8.16.1 and earlier have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which may lead to SQL injections...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.5.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient cleaning and escaping of the srcby parameter, as well as inadequate preparation of existing SQL queries. This could allow unauthenticated attackers to append additional SQL...

The cosy icecms SQL injection vulnerability

The thecosy icecms versions 4.1.5 and earlier have a SQL injection vulnerability. This vulnerability stems from unvalidated SQL injections. Attackers can append additional SQL statements after the LIMIT clause in the QueryWrapper.last method by providing specially crafted inputs to the num...

Helicalinsight SQL injection vulnerability

Helicalinsight versions 7.0.0 and earlier have a SQL injection vulnerability. This vulnerability arises from report parameter values sent to /executeDatasource that are not properly escaped. Attackers can use custom Numeric or String placeholder values to bypass the ineffective SqlDetect...

Kuafuai Aipexbase has a SQL injection vulnerability

The Kuafuai Aipexbase 690adb9 and previous versions have a SQL injection vulnerability. This vulnerability stems from the orderby and groupby fields in the/api/data/invoke endpoint. Attackers can exploit this vulnerability to bypass the SqlGuard blacklist and row-level security by using subquerie...

zyx0814 FilePress SQL injection vulnerability

The Zyx0814 FilePress 3.0.1 and earlier versions have a SQL injection vulnerability. This vulnerability arises from the lack of validation for the asc parameter, allowing attackers to exploit blind Boolean or time-based subqueries to extract database rows, including administrator credentials hash...

PBH-BTN PeerBanHelper SQL Injection Vulnerability

The PBH-BTN PeerBanHelper versions from 5.0.0 to 9.3.15 had an SQL injection vulnerability. This vulnerability stemmed from the /api/statistic/analysis/field endpoint, which improperly handled field query parameters provided by authenticated users. The mapField method did not clean up unrecognize...

YuePeng has a SQL injection vulnerability

YuePeng ERUPT: Versions 2.3.0 and earlier have a SQL injection vulnerability. This vulnerability arises from failing to escape the linkTreeVal parameter in the POST request for /erupt-api/data/table/erupt, allowing HQL injection. This may enable authenticated users to bypass the tree scope data...

Frappe HR SQL Injection Vulnerability

Versions of Frappe HR prior to 15.60.3 and from 16.0.0 to 16.7.1 have a SQL injection vulnerability. This vulnerability arises from the use of insecure SQL string interpolation in the Salary Payments via ECS report, which allows authenticated HR users to inject SQL statements through report filte...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.6.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper cleaning of user input for the parameters srcby.val.start / srcby.val.end operator 'bt', and insufficient preparation of existing SQL queries. This leads to blind SQL injections...

izhaorui Zr.Admin.NET SQL Injection Vulnerability

Zr.Admin.NET versions 3.8.2 and earlier have a SQL injection vulnerability. This vulnerability stems from the use of the GET /system/user/list endpoint to pass a specially crafted PagerInfo.Sort query parameter to the shared ToPage pagination helper function. Attackers can exploit this...

TSG Profleet SQL Injection Vulnerability

Versions of TSG Profleet prior to 16/10/2026 contained an SQL injection vulnerability. This vulnerability stemmed from incorrect handling of the Identificación parameter in the /cgi-bin/index.php file. It could allow SQL injections, and attackers could use GET requests to retrieve, create, update...

The cosy icecms SQL injection vulnerability

The thecosy icecms 4.1.5 and earlier versions have a SQL injection vulnerability. This vulnerability arises from the lack of validation for the num path parameter in the /WebArticle/findarticlesbynum route. This makes the system vulnerable to SQL injection attacks. A remote attacker can append...

WordPress Booking System SQL Injection Vulnerability

The WordPress Booking System 2.1.0.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the parameter dataorderby and inadequate preparation of existing SQL queries. It is possible for authenticated attackers with administrator or highe...

Tatsh bincookie SQL injection vulnerability

Versions of Tatsh Bincookie prior to 7.6.3 have a SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, which may lead to blind SQL injections...