287966 matches found
Helicalinsight SQL injection vulnerability
Helicalinsight versions 7.0.0 and earlier have a SQL injection vulnerability. This vulnerability arises from report parameter values sent to /executeDatasource that are not properly escaped. Attackers can use custom Numeric or String placeholder values to bypass the ineffective SqlDetect...
TSG Profleet SQL Injection Vulnerability
Versions of TSG Profleet prior to 16/10/2026 contained an SQL injection vulnerability. This vulnerability stemmed from incorrect handling of the Identificación parameter in the /cgi-bin/index.php file. It could allow SQL injections, and attackers could use GET requests to retrieve, create, update...
WordPress MapSVG SQL Injection Vulnerability
WordPress MapSVG versions 8.16.1 and earlier have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which may lead to SQL injections...
WordPress SQL Chart Builder has a cross-site scripting vulnerability
WordPress SQL Chart Builder 3.0.6 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with privileges of subscriber or higher to inject arbitrary web scripts. This...
Tatsh bincookie SQL injection vulnerability
Versions of Tatsh Bincookie prior to 7.6.3 have a SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, which may lead to blind SQL injections...
PBH-BTN PeerBanHelper SQL Injection Vulnerability
The PBH-BTN PeerBanHelper versions from 5.0.0 to 9.3.15 had an SQL injection vulnerability. This vulnerability stemmed from the /api/statistic/analysis/field endpoint, which improperly handled field query parameters provided by authenticated users. The mapField method did not clean up unrecognize...
WebVella ERP SQL Injection Vulnerability
WebVella ERP versions 1.8.8 and earlier have a SQL injection vulnerability. This vulnerability stems from the fact that the literal expressions in the WHERE clause of the EQL query API are not cleaned properly. Attackers can exploit this vulnerability by sending specially crafted single-quote...
YuePeng has a SQL injection vulnerability
YuePeng ERUPT: Versions 2.3.0 and earlier have a SQL injection vulnerability. This vulnerability arises from failing to escape the linkTreeVal parameter in the POST request for /erupt-api/data/table/erupt, allowing HQL injection. This may enable authenticated users to bypass the tree scope data...
WordPress Vitepos SQL Injection Vulnerability
WordPress Vitepos 3.6.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper cleaning of user input for the parameters srcby.val.start / srcby.val.end operator 'bt', and insufficient preparation of existing SQL queries. This leads to blind SQL injections...
WordPress Mail Mint SQL Injection Vulnerability
WordPress Mail Mint 1.31.4 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper handling of the filters parameter in the /wp-json/mrm/v1/segments/contacts REST endpoint. The value of the filter parameter provided by users is insufficiently escaped. In li...
WordPress FluentCart: A New Era of eCommerce SQL Injection Vulnerabilities
WordPress FluentCart – A New Era of eCommerce. Versions 1.7.0 and earlier have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the parameter ‘products.variants.’ and inadequate SQL query preparation. This could allow authenticated attackers to append addition...
zyx0814 FilePress SQL injection vulnerability
The Zyx0814 FilePress 3.0.1 and earlier versions have a SQL injection vulnerability. This vulnerability arises from the lack of validation for the asc parameter, allowing attackers to exploit blind Boolean or time-based subqueries to extract database rows, including administrator credentials hash...
The cosy icecms SQL injection vulnerability
The thecosy icecms versions 4.1.5 and earlier have a SQL injection vulnerability. This vulnerability stems from unvalidated SQL injections. Attackers can append additional SQL statements after the LIMIT clause in the QueryWrapper.last method by providing specially crafted inputs to the num...
WordPress Backuply has a SQL injection vulnerability
WordPress Backuply 1.5.8 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of user-provided parameters in the Biographical Info field, as well as inadequate preparation of existing SQL queries. Attackers can trigger second-stage SQL...
Frappe HR SQL Injection Vulnerability
Versions of Frappe before 14.38.2, as well as versions before 14.x before 15.64.0, 15.x before 16.18.0, and 16.x before 16.18.0 have a SQL injection vulnerability. This vulnerability stems from the lack of input validation on certain endpoints, which may lead to SQL injections. Any authenticated...
Frappe HR SQL Injection Vulnerability
Versions of Frappe HR prior to 15.60.3 and from 16.0.0 to 16.7.1 have a SQL injection vulnerability. This vulnerability arises from the use of insecure SQL string interpolation in the Salary Payments via ECS report, which allows authenticated HR users to inject SQL statements through report filte...
Databufflabs Databuff Encryption Vulnerabilities
Databufflabs Databuff versions 0.1.10 and earlier have an encryption-related vulnerability. This vulnerability stems from the use of a hard-coded HMAC key in the JwtTokenService. An attacker can exploit this vulnerability to forge administrator session tokens using the default dev-secret. Without...
WHEELS.DEV: Wheels SQL injection vulnerability
WHEELS.DEV: Versions of Wheels 4.1.2 and earlier have an SQL injection vulnerability. This vulnerability occurs in MySQL/MariaDB environments where escape characters are enabled. When the application provides request data to inline literal paths, it does not consider escape characters and simply...
The cosy icecms SQL injection vulnerability
The thecosy icecms 4.1.5 and earlier versions have a SQL injection vulnerability. This vulnerability arises from the lack of validation for the num path parameter in the /WebArticle/findarticlesbynum route. This makes the system vulnerable to SQL injection attacks. A remote attacker can append...
WordPress Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance plugin <= 1.31.4 - Authenticated (Custom+) SQL Injection vulnerability
Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.4...