TSG Profleet SQL Injection Vulnerability

Versions of TSG Profleet prior to 16/10/2026 contained an SQL injection vulnerability. This vulnerability stemmed from incorrect handling of the Identificación parameter in the /cgi-bin/index.php file. It could allow SQL injections, and attackers could use GET requests to retrieve, create, update...

zyx0814 FilePress SQL injection vulnerability

The Zyx0814 FilePress 3.0.1 and earlier versions have a SQL injection vulnerability. This vulnerability arises from the lack of validation for the asc parameter, allowing attackers to exploit blind Boolean or time-based subqueries to extract database rows, including administrator credentials hash...

WordPress FluentCart: A New Era of eCommerce SQL Injection Vulnerabilities

WordPress FluentCart – A New Era of eCommerce. Versions 1.7.0 and earlier have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the parameter ‘products.variants.’ and inadequate SQL query preparation. This could allow authenticated attackers to append addition...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.5.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient cleaning and escaping of the srcby parameter, as well as inadequate preparation of existing SQL queries. This could allow unauthenticated attackers to append additional SQL...

The cosy icecms SQL injection vulnerability

The thecosy icecms versions 4.1.5 and earlier have a SQL injection vulnerability. This vulnerability stems from unvalidated SQL injections. Attackers can append additional SQL statements after the LIMIT clause in the QueryWrapper.last method by providing specially crafted inputs to the num...

Helicalinsight SQL injection vulnerability

Helicalinsight versions 7.0.0 and earlier have a SQL injection vulnerability. This vulnerability arises from report parameter values sent to /executeDatasource that are not properly escaped. Attackers can use custom Numeric or String placeholder values to bypass the ineffective SqlDetect...

Kuafuai Aipexbase has a SQL injection vulnerability

The Kuafuai Aipexbase 690adb9 and previous versions have a SQL injection vulnerability. This vulnerability stems from the orderby and groupby fields in the/api/data/invoke endpoint. Attackers can exploit this vulnerability to bypass the SqlGuard blacklist and row-level security by using subquerie...

PBH-BTN PeerBanHelper SQL Injection Vulnerability

The PBH-BTN PeerBanHelper versions from 5.0.0 to 9.3.15 had an SQL injection vulnerability. This vulnerability stemmed from the /api/statistic/analysis/field endpoint, which improperly handled field query parameters provided by authenticated users. The mapField method did not clean up unrecognize...

WordPress Backuply has a SQL injection vulnerability

WordPress Backuply 1.5.8 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of user-provided parameters in the Biographical Info field, as well as inadequate preparation of existing SQL queries. Attackers can trigger second-stage SQL...

WebVella ERP SQL Injection Vulnerability

WebVella ERP versions 1.8.8 and earlier have a SQL injection vulnerability. This vulnerability stems from the fact that the literal expressions in the WHERE clause of the EQL query API are not cleaned properly. Attackers can exploit this vulnerability by sending specially crafted single-quote...

YuePeng has a SQL injection vulnerability

YuePeng ERUPT: Versions 2.3.0 and earlier have a SQL injection vulnerability. This vulnerability arises from failing to escape the linkTreeVal parameter in the POST request for /erupt-api/data/table/erupt, allowing HQL injection. This may enable authenticated users to bypass the tree scope data...

Frappe HR SQL Injection Vulnerability

Versions of Frappe HR prior to 15.60.3 and from 16.0.0 to 16.7.1 have a SQL injection vulnerability. This vulnerability arises from the use of insecure SQL string interpolation in the Salary Payments via ECS report, which allows authenticated HR users to inject SQL statements through report filte...

izhaorui Zr.Admin.NET SQL Injection Vulnerability

Zr.Admin.NET versions 3.8.2 and earlier have a SQL injection vulnerability. This vulnerability stems from the use of the GET /system/user/list endpoint to pass a specially crafted PagerInfo.Sort query parameter to the shared ToPage pagination helper function. Attackers can exploit this...

The cosy icecms SQL injection vulnerability

The thecosy icecms 4.1.5 and earlier versions have a SQL injection vulnerability. This vulnerability arises from the lack of validation for the num path parameter in the /WebArticle/findarticlesbynum route. This makes the system vulnerable to SQL injection attacks. A remote attacker can append...

WordPress Booking System SQL Injection Vulnerability

The WordPress Booking System 2.1.0.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the parameter dataorderby and inadequate preparation of existing SQL queries. It is possible for authenticated attackers with administrator or highe...

MariaDB Server SQL injection vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a SQL injection vulnerability. This vulnerability arises from the fact that functions such as SHOW CREATE SERVER, SHOW CREATE USER, and...

Apache Kylin authorization issue vulnerability

A security vulnerability exists in Apache Kylin versions 5 through 5.0.4. This vulnerability stems from the lack of authentication in the backend cache API, making it susceptible to SQL injection attacks that could lead to the execution of malicious SQL statements...

Tatsh bincookie SQL injection vulnerability

Versions of Tatsh Bincookie prior to 7.6.3 have a SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, which may lead to blind SQL injections...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.6.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper cleaning of user input for the parameters srcby.val.start / srcby.val.end operator 'bt', and insufficient preparation of existing SQL queries. This leads to blind SQL injections...

WordPress Mail Mint SQL Injection Vulnerability

WordPress Mail Mint 1.31.4 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper handling of the filters parameter in the /wp-json/mrm/v1/segments/contacts REST endpoint. The value of the filter parameter provided by users is insufficiently escaped. In li...