CVE-2024-8436

CRITICAL Year: 2024
CVSS v3 Score
9.9
Critical
Weakness Type
CWE-89
View all →

Vulnerability Description

The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'edit_imageId' and 'edit_imageDelete' parameters in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Related Vulnerabilities

CVE-2018-20091

CRITICAL
CVSS:9.9(Critical)

An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal databas...

CWE-892018

CVE-2021-21465

CRITICAL
CVSS:9.9(Critical)

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the databa...

CWE-892021

CVE-2021-38176

CRITICAL
CVSS:9.9(Critical)

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABA...

CWE-892021

CVE-2024-30236

CRITICAL
CVSS:9.9(Critical)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contest Gallery.This issue affects Contest Gallery: from n/a through 21.3.4.

CWE-892024

CVE-2024-42327

CRITICAL
CVSS:9.9(Critical)

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRel...

CWE-892024

CVE-2024-51482

CRITICAL
CVSS:9.9(Critical)

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is ...

CWE-892024