The vulnerability in the GLPI system’s handling of requests and incidents, related to improper neutralization of special elements used in SQL commands, allows an attacker to carry out an attack based on time, using SQL injections in the REST API user_token.

The vulnerability of the GLPI system for handling requests and incidents is related to the improper neutralization of certain special elements. Exploiting this vulnerability allows a malicious actor to scan server ports or services, and to carry out attacks based on timing, using SQL injections i...

Admidio has Blind SQL Injection in ecard_send.php

Description: An SQL Injection has been identified in the /admprogram/modules/ecards/ecardsend.php source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of ecardrecipients POST parameter is being directly concatenated with the SQ...

Craft CMS 安全漏洞

Craft CMS is Craft CMS open source content management system CMS. An access control error vulnerability exists in Craft CMS versions 5.0.0-beta.1 through 5.2.2, which stems from allowing multiple reuses of a TOTP token during its validity period. An attacker can exploit the vulnerability by...

PT-2024-29567 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions prior to 5.2.3 Description: Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that th...

CVE-2024-6338: Improper Neutralization of Special Elements used in an SQL Command

The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

CVE-2024-6457

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woofauthor’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

WordPress HUSKY plugin <= 1.3.6 - Unauthenticated Time-Based SQL Injection vulnerability

Unauthenticated Time-Based SQL Injection vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin HUSKY versions = 1.3.6...

CVE-2024-6457: Improper Neutralization of Special Elements used in an SQL Command

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woofauthor’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-39909: Improper Neutralization of Special Elements used in an SQL Command

KubeClarity is a tool for detection and management of Software Bill Of Materials SBOM and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource /api/applicationResources via the following parameter packageID. As it can be seen in...

CVE-2024-5792

CVE-2024-5792 affects Houzez CRM (WordPress) plugin up to version 1.4.2, exposing a time-based SQL Injection via the notes parameter bel ong_to, exploitable by authenticated users with Custom-level (seller) access or higher. Root cause: insufficient escaping/parameter handling in the existing SQL...

WordPress plugin Houzez CRM security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-5792: Improper Neutralization of Special Elements used in an SQL Command

The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belongto’ parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2024-37158 · WordPress · Houzez Crm

Name of the Vulnerable Software and Affected Versions: Houzez CRM plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to time-based SQL Injection via the notes belong to parameter due to insufficient escaping on the user-supplied parameter and lack of...

WordPress Unlimited Elements For Elementor plugin <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection vulnerability

Authenticated Contributor+ Time-Based SQL Injection vulnerability discovered by shaman0x01 in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.112...

CVE-2024-6166 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addonsorder’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-6166: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addonsorder’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress Poll 2.3.6 SQL Injection

Exploit Title: WordPress Poll Plugin SQL Injection Date: 2024-07-06 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://total-soft.com/wp-poll/ Version 2.3.6 1. Access the Admin Panel: - Navigate to the admin panel of your WordPress site. - Go to TS Poll Create Pool Use Theme and...

PT-2024-39060

Name of the Vulnerable Software and Affected Versions: VICIdial version 2.14-917a Description: An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database. An...

Azon Dominator Affiliate Marketing Script - SQL Injection Vulnerability

Exploit Title: Azon Dominator - Affiliate Marketing Script - SQL Injection Exploit Author: Buğra Enis Dönmez Vendor: https://www.codester.com/items/12775/azon-dominator-affiliate-marketing-script Demo Site: https://azon-dominator.webister.net/ Tested on: Arch Linux CVE: N/A Request POST...

PT-2024-37432

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin versions up to, and including, 5.7.25 Description: The issue allows unauthenticated attackers to perform time-based SQL Injecti...