Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
- satya-vinay Events-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
satya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection
- satya-vinay Events-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection
- subhajitkhan online-clinic-management-system
- Other injection
- SQL injection
- CVSS 5.3 Medium
Apache Kylin: tables/names SparkSQL injection
- Apache Software Foundation Apache Kylin
- SQL injection
- CVSS 8.8 High
SQL Injection in the Integratec Application
- Integratec
- SQL injection
- CVSS 5.3 Medium
Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection
- Dav-ee dairy-management-system
- Other injection
- SQL injection
- CVSS 5.1 Medium
Dav-ee dairy-management-system delete.php mysqli_query sql injection
- Dav-ee dairy-management-system
- Other injection
- SQL injection
- CVSS 5.3 Medium
Dav-ee dairy-management-system add.php mysqli_query sql injection
- Dav-ee dairy-management-system
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Cake Ordering System confirm.php sql injection
- itsourcecode Online Cake Ordering System
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
- SQL injection
- CVSS 8.8 High
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index…
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.…
- SQL injection
- CVSS 5.1 Medium
aircheng-org iWebShop-5 util.php search sql injection
- aircheng-org iWebShop-5
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection
- itsmeravitejak Online-Examination-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection
- kishan0725 Hospital Management System
- Other injection
- SQL injection
- CVSS 7.1 High
JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass
- JeecgBoot
- SQL injection
- CVSS 8.5 High
WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability
- DevItems Support Genix
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability
- Arraytics Booktics
- SQL injection
- CVSS 7.7 High
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
- Modern Events Calendar Lite
- Modern Event Calendar Pro
- SQL injection
- CVSS 6.9 Medium
itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection
- itsmeravitejak Online-Examination-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsmeravitejak Online-Examination-System database.php getreport sql injection
- itsmeravitejak Online-Examination-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsmeravitejak Online-Examination-System subjectsdb.php sql injection
- itsmeravitejak Online-Examination-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
nemoTyrant manong func.php arr2sql sql injection
- nemoTyrant manong
- Other injection
- SQL injection
- CVSS 6.8 Medium
Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name
- Ukr-To-Lat
- SQL injection
- CVSS 6.8 Medium
BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute
- BSK PDF Manager
- SQL injection
- CVSS 4.9 Medium
Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
- uscnanbu Welcart e-Commerce
- SQL injection
- CVSS 6.5 Medium
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
- frappe hrms
- SQL injection
- CVSS 7.1 High
AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
- kuafuai aipexbase
- SQL injection
- CVSS 7.1 High
WebVella ERP through 1.8.8 SQL Injection via EQL Query API
- WebVella-ERP
- SQL injection
- CVSS 8.7 High
IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum
- Thecosy IceCMS
- SQL injection
- CVSS 8.7 High
IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum
- Thecosy IceCMS
- SQL injection
- CVSS 7.1 High
ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY
- izhaorui Zr.Admin.NET
- SQL injection
- CVSS 8.6 High
Helical Insight through 7.0.0 SQL Injection via /executeDatasource
- helicalinsight
- SQL injection
- CVSS 7.1 High
FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
- zyx0814 FilePress
- SQL injection
- CVSS 4.9 Medium
PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint
- PBH-BTN PeerBanHelper
- SQL injection
- CVSS 7.7 High
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
- MariaDB server
- SQL injection
- CVSS 8.5 High
WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability
- PT Norther Lights Production MapSVG
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: Missing authentication on certain cache API endpoints
- Apache Software Foundation Apache Kylin
- SQL injection
- Authentication bypass
- CVSS 6.0 Medium
Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API
- erupt
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL injection in TSG Profleet
- TSG Profleet
- SQL injection
- CVSS 7.5 High
Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter
- appsbd Vitepos – Point of Sale (POS) for WooCommerce
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability
- halfdata Green Popups
- SQL injection
- CVSS 4.9 Medium
WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- murgroland WP Booking System – Booking Calendar
- SQL injection
- CVSS 6.8 Medium
affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
- affiliate-toolkit
- SQL injection
- CVSS 6.8 Medium
Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter
- Mobile builder
- SQL injection
- CVSS 6.8 Medium
WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter
- WX Subscribe 微信支付付费订阅
- SQL injection
- CVSS 6.5 Medium
Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
- appsbd Vitepos – Point of Sale (POS) for WooCommerce
- SQL injection
- CVSS 6.5 Medium
Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter
- getwpfunnels Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
- SQL injection
- CVSS 8.0 High
Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
- softaculous Backuply – Backup, Restore, Migrate and Clone
- SQL injection
- CVSS 4.9 Medium
FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
- wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection in Wheels
- Wheels
- SQL injection
- CVSS 8.3 High
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
- frappe hrms
- SQL injection
- CVSS 6.5 Medium
GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php
- mayerbalintdev GYM-One
- SQL injection
- CVSS 8.8 High
Tianji: SQL Injection via unsanitized timezone parameter in analytics queries
- msgbyte tianji
- SQL injection
- CVSS 7.6 High
EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
- espocrm
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
- Link Whisper INC Link Whisper Free
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
- Kitae Park Mang Board WP
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
- TMS Amelia
- SQL injection
- CVSS 7.1 High
SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset
- QNAP Systems Inc. Video Station
- SQL injection
- CVSS 7.1 High
SQLi#1 SQL Injection in class_videos.php _getFilters
- QNAP Systems Inc. Video Station
- SQL injection