CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24456 – Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections
https://notcve.org/view.php?id=CVE-2021-24456
The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard El plugin Quiz Maker WordPress versiones anteriores a 6.2.0.9, no saneaba y escapaba correctamente los parámetros order y orderby antes de usarlos en sentencias SQL, conllevando a problemas de inyección SQL en el panel de administración • https://wpscan.com/vulnerability/929ad37d-9cdb-4117-8cd3-cf7130a7c9d4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24461 – FAQ Builder < 1.3.6 - Authenticated Blind SQL Injections
https://notcve.org/view.php?id=CVE-2021-24461
The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard La función get_faqs() del plugin de WordPress FAQ Builder AYS versiones anteriores a 1.3.6, no usaba la lista blanca ni comprobaba el parámetro orderby antes de usarlo en las sentencias SQL pasadas a las llamadas a la base de datos get_results(), conllevando a problemas de inyección SQL en el panel de control del administrador • https://wpscan.com/vulnerability/311974b5-6d6e-4b47-a33d-6d8f468aa528 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24458 – Popup box < 2.3.4 - Authenticated Blind SQL Injections
https://notcve.org/view.php?id=CVE-2021-24458
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard Las funciones get_ays_popupboxes() y get_popup_categories() del plugin Popup box de WordPress versiones anteriores a 2.3.4, no usaban la lista blanca ni comprobaban el parámetro orderby antes de usarlo en las sentencias SQL pasadas a las llamadas a la base de datos get_results(), conllevando a problemas de inyección SQL en el panel de administración The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard. • https://wpscan.com/vulnerability/8a588266-54cd-4779-adcf-f9b9e226c297 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24463 – Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL Injection
https://notcve.org/view.php?id=CVE-2021-24463
The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard La función get_sliders() del plugin de WordPress Image Slider by Ays- Responsive Slider and Carousel versiones anteriores a 2.5.0, no usaba la lista blanca ni comprobaba el parámetro orderby antes de usarlo en las sentencias SQL pasadas a las llamadas a la base de datos get_results(), conllevando a problemas de inyección SQL en el panel de administración • https://wpscan.com/vulnerability/994e6198-f0e9-4e30-989f-b5a3dfe95ded • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10921 – Photo Gallery by Ays – Responsive Image Gallery < 1.0.1 - SQL Injection
https://notcve.org/view.php?id=CVE-2016-10921
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection. El plugin gallery-photo-gallery versiones anteriores a 1.0.1 para WordPress, presenta una inyección SQL. The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to 1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://wordpress.org/plugins/gallery-photo-gallery/#developers • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •