1049 matches found
WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection
WordPress Visitor Statistics Real Time Traffic plugin before 4.8 does not properly sanitize and escape the refUrl in the refDetails AJAX action, which is available to any authenticated user. This could allow users with a role as low as subscriber to perform SQL injection attacks. id: CVE-2021-247...
WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection
The plugin does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks. id: CVE-2023-0600 info: name: WP Visitor Statistics Real Time Traffic 6.9 - SQL Injection author: r3Y3r53,j4vaovo severity: critical description: | The...
Company Visitor Management System 1.0 - SQL Injection
Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id...
CVE-2026-65644
CVE-2026-65644 is a stored XSS in Rocket.Chat's Omnichannel livechat visitor name field, rendered via dangerouslySetInnerHTML in InquireSidePanelItem.tsx, allowing unauthenticated attackers to inject clickable links into agent views. Patch PR #41595 fixes it in versions 7.10.15 and 8.1.8+. Exploi...
PT-2026-79291
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...
CVE-2026-77020 CodeAstro Apartment Visitor Management System password-recovery.php sql injection
A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...
EUVD-2026-63421
A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...
CVE-2026-77019
CodeAstro Apartment Visitor Management System 1.0 has a SQL injection in /apartment-visitor/forgotpw.php via the secode argument, exploitable remotely without authentication (CVSS 7.5 HIGH). A proof-of-concept exploit is publicly disclosed; no patch version is provided. Exploitation details are n...
PT-2026-79056
A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...
PT-2026-79068
A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...
CVE-2026-14287
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...
CVE-2026-66429
Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-66430
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-66430
CVE-2026-66430 describes an SQL Injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions
CVE-2026-66430 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
EUVD-2026-57863
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-66430
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
EUVD-2026-57862
Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-66429
The CVE concerns WordPress Plugin Visitor Traffic Real Time Statistics Pro (versions up to 11.10) with an unauthenticated Cross-Site Scripting (XSS) vulnerability. The affected component is the plugin’s web-facing handling that allows injection of script by an attacker without authentication; imp...