Vulnerabilities > Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2025-01-23 | CVE-2024-13236 | SQL Injection vulnerability in Tainacan The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collection_id' parameter in all versions up to, and including, 0.21.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | 6.5 |
| 2025-01-23 | CVE-2024-13234 | SQL Injection vulnerability in Woobewoo Product Table 1.9.5 The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | 9.8 |
| 2025-01-22 | CVE-2024-13496 | SQL Injection vulnerability in Gamipress The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | 7.5 |
| 2025-01-22 | CVE-2024-13426 | SQL Injection vulnerability in Wp-Polls Project Wp-Polls The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | 5.3 |
| 2025-01-21 | CVE-2025-22716 | SQL Injection vulnerability in Taskbuilder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Team Taskbuilder allows SQL Injection. | 8.8 |
| 2025-01-21 | CVE-2024-13230 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | 5.3 |
| 2025-01-20 | CVE-2025-0585 | The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. | 9.8 |
| 2025-01-19 | CVE-2025-0564 | SQL Injection vulnerability in Anisha Fantasy-Cricket 1.0 A vulnerability was found in code-projects Fantasy-Cricket 1.0. | 9.8 |
| 2025-01-19 | CVE-2025-0562 | SQL Injection vulnerability in Codezips GYM Management System 1.0 A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. | 9.8 |
| 2025-01-19 | CVE-2025-0563 | SQL Injection vulnerability in Anisha Fantasy-Cricket 1.0 A vulnerability was found in code-projects Fantasy-Cricket 1.0. | 9.8 |