CVE-2024-9130

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Sep 27, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-91317.2A user with administrator privileges can perform command injectionCVE-2024-91329.8The administrator is able to configure an insecure captive portal scriptCVE-2024-91335.6A user with administrator privileges is able to retrieve authentication tokensCVE-2024-91348.3Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploiCVE-2024-91355.3On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may resuCVE-2024-91367.5Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect sCVE-2024-91379.4The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an atCVE-2024-91387.2Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This CVE-2024-91397.2The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrarCVE-2024-91409.8Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulneCVE-2024-91415.4Cross-Site Scripting (XSS) vulnerability in the Oct8ne system. This flaw could allow an attacker to embed harmful JavaScript code into the bCVE-2024-91429.8External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Bele