bylancer

7 results · Clear filters · Feed

• Medium 5.4
  CVE-2018-25334

  Zechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter

  Zechat 1.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to change a user's information by bypassing anti-CSRF protections. The application uses a CSRF token, but an attacker can use the hashtag parameter to inject an enco…

  bylancer Zechat
  May 17, 2026
• Medium 4.9
  CVE-2025-13385

  Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter

  The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter…

  bylancer Bookme – Free Online Appointment Booking and Scheduling Plugin Web / CMS
  Nov 25, 2025
• Medium 6.3
  CVE-2023-3690

  Bylancer QuickOrder GET Parameter blog sql injection

  A vulnerability, which was classified as critical, has been found in Bylancer QuickOrder 6.3.7. Affected by this issue is some unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql inje…

  bylancer QuickOrder
  Jul 16, 2023
• Medium 6.3
  CVE-2023-3689

  Bylancer QuickQR GET Parameter blog sql injection

  A vulnerability classified as critical was found in Bylancer QuickQR 6.3.7. Affected by this vulnerability is an unknown functionality of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The att…

  bylancer QuickQR
  Jul 16, 2023
• Medium 6.3
  CVE-2023-3688

  Bylancer QuickJob GET Parameter sql injection

  A vulnerability classified as critical has been found in Bylancer QuickJob 6.1. Affected is an unknown function of the component GET Parameter Handler. The manipulation of the argument keywords/gender leads to sql injection. It is possible to launch the attac…

  bylancer QuickJob
  Jul 16, 2023
• Medium 6.3
  CVE-2023-3687

  Bylancer QuickVCard GET Parameter blog sql injection

  A vulnerability was found in Bylancer QuickVCard 2.1. It has been rated as critical. This issue affects some unknown processing of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may…

  bylancer QuickVCard
  Jul 16, 2023
• Medium 6.3
  CVE-2023-3686

  Bylancer QuickAI OpenAI GET Parameter blog sql injection

  A vulnerability was found in Bylancer QuickAI OpenAI 3.8.1. It has been declared as critical. This vulnerability affects unknown code of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The atta…

  bylancer QuickAI OpenAI
  Jul 16, 2023