https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:41:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-324167 EUVD-2026-324167 https://cve.radiocsirt.org/vuln/euvd-2026-324167 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5073 <p>The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the &#39;order&#39; parameter of the &#39;arm_directory_paging_action&#39; AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied &#39;order&#39; and &#39;orderby&#39; parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p>The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the &#39;order&#39; parameter of the &#39;arm_directory_paging_action&#39; AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied &#39;order&#39; and &#39;orderby&#39; parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-5073 https://cve.radiocsirt.org/vuln/ghsa-p4qm-892g-4gm7 <p>The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the &#39;order&#39; parameter of the &#39;arm_directory_paging_action&#39; AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied &#39;order&#39; and &#39;orderby&#39; parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p>The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the &#39;order&#39; parameter of the &#39;arm_directory_paging_action&#39; AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied &#39;order&#39; and &#39;orderby&#39; parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://cve.radiocsirt.org/vuln/ghsa-p4qm-892g-4gm7