SQL injection.

SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection

• SourceCodester Pet Grooming Management Software
• Other injection
• SQL injection

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5

• joomlack.fr Page Builder CK extension for Joomla
• SQL injection

itsourcecode Hospital Management System viewprescriptionrecord.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service

• Google Cloud Google SecOps (Chronicle SOAR)
• SQL injection

itsourcecode Hospital Management System viewpaymentreport.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

itsourcecode Hospital Management System viewpatient.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality.

• SQL injection

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

• SQL injection

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.

• SQL injection

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability.

• SQL injection

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

• phoca.cz Phoca Cart extension for Joomla
• SQL injection

Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys

• Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress
• SQL injection

WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter

• WP Directory Kit
• SQL injection

WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter

• wcvendors WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
• SQL injection

The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter

• weblizar The School Management – Education & Learning ERP
• SQL injection

Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)

• quantumcloud Slider Hero with Video Background, Animation
• SQL injection

User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter

• faiyazalam User Login History
• SQL injection

itsourcecode Hospital Management System vieworder.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option

• expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
• SQL injection

Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content

• pdamsten Fullscreen Galleria
• SQL injection

NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter

• webaways NEX-Forms – Ultimate Forms Plugin for WordPress
• SQL injection

Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection

• Evergreen
• Other injection
• SQL injection

SourceCodester Stock Management System Master.php delete_supplier sql injection

• SourceCodester Stock Management System
• Other injection
• SQL injection

code-projects Online Shopping System checkout_process.php sql injection

• code-projects Online Shopping System
• Other injection
• SQL injection

code-projects Online Shopping System homeaction.php sql injection

• code-projects Online Shopping System
• Other injection
• SQL injection

code-projects Online Shopping System action.php sql injection

• code-projects Online Shopping System
• Other injection
• SQL injection

code-projects Online Shopping System Login login.php sql injection

• code-projects Online Shopping System
• Other injection
• SQL injection

code-projects Online Food Order System delete_food_items1.php sql injection

• code-projects Online Food Order System
• Other injection
• SQL injection

Jinher OA attendance_out_approve.aspx sql injection

• Jinher OA
• Other injection
• SQL injection

SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection

• SourceCodester Class and Exam Timetabling System
• Other injection
• SQL injection

itsourcecode Hospital Management System viewmedicine.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter

• WPML Multilingual CMS
• SQL injection

Authenticated SQL Injection in AppFlowy

• AppFlowy-IO AppFlowy-Cloud
• SQL injection

Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values

• matthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
• SQL injection

KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter

• iqonicdesign KiviCare – Clinic & Patient Management System (EHR)
• SQL injection

Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter

• matthiasnordwig Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
• SQL injection

Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'

• contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
• SQL injection

Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause

• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
• SQL injection

Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter

• trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
• SQL injection

Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection

• minnpost Object Sync for Salesforce
• SQL injection

Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter

• fishpie Image Uploader for Welcart
• SQL injection

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11

• icagenda.com iCagenda extension for Joomla
• SQL injection

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11

• icagenda.com iCagenda extension for Joomla
• SQL injection

IBM Db2 Mirror for i is affected by multiple vulnerabilities

• IBM Db2 Mirror for i
• SQL injection

LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB

• LimeSurvey
• SQL injection

Metacat has an unauthenticated SQL injection vulnerability

• NCEAS metacat
• SQL injection
• Authentication bypass

Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function

• emlog
• SQL injection

SQL Injection

• Tenable, Inc. Security Center
• SQL injection

SQL Injection

• Tenable, Inc. Security Center
• SQL injection

SourceCodester Simple Client Management System Master.php save_service sql injection

• SourceCodester Simple Client Management System
• Other injection
• SQL injection

Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

• SQL injection

* · no fixed version yet

Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

• Paymob for WooCommerce
• SQL injection

affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

• cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
• SQL injection

Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter

• bitpressadmin Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
• SQL injection

SourceCodester Air Cargo Management System Master.php save_cargo_type sql injection

• SourceCodester Air Cargo Management System
• Other injection
• SQL injection

francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection

• francoisjacquet RosarioSIS
• Other injection
• SQL injection

itsourcecode Hospital Management System viewdoctortimings.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

Raisecom Communication Command and Dispatch Management Platform getpwd.php sql injection

• Raisecom Communication Command and Dispatch Management Platform
• Other injection
• SQL injection

Budibase before 3.40.0 SQL Injection via Oracle connector

• budibase
• SQL injection

Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

• budibase server
• SQL injection