CVE-2025-50867

Une vulnérabilité d'injection SQL existe dans le point de terminaison takeassessment2.php de CloudClassroom-PHP-Project 1.0, où le paramètre POST Q5 est directement intégré dans des instructions SQL sans assainissement. Type de vulnérabilité : Injection SQL Vendeur du produit :...

CVE-2026-74251

Неаутентифицированная SQL-инъекция через фильтр атрибутов в Phoca Cart Phoca Cart ≤ 6.1.6 — неаутентифицированный злоумышленник извлекает всю базу данных с помощью time-based blind инъекции КРАТКОЕ ОПИСАНИЕ Параметры GET-массивов a атрибут и s спецификация на публичной странице товаров магазина...

CVE-2026-2413-POC

CVE-2026-2413-POC WordPress용 Ally – Web Accessibility & Usability 플러그인은 4.0.3을 포함한 모든 버전에서 URL 경로를 통한 SQL 인젝션에 취약합니다. 이는 getglobalremediations 메서드에서 사용자 제공 URL 매개변수에 대한 이스케이프 처리가 충분하지 않기 때문이며, 해당 매개변수는 SQL 컨텍스트에 대한 적절한 삭제샌니타이제이션 없이 SQL JOIN 절에 직접 연결됩니다. URL 안전을 위해 escurlraw가 적용되지만, 이는 SQL...

CVE-2021-39379

УЯЗВИМОСТЬ SQL-ИНЪЕКЦИИ В OPENSIS 8.0 CVE-2021-39379 В версии 8.0 openSIS существует уязвимость SQL-инъекции при использовании MySQL MariaDB в качестве базы данных приложения. Злоумышленник может выполнять SQL-команды в базе данных MySQL MariaDB через уязвимый параметр passwordstnid. Уязвимая...

PT-2026-54949

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp load more revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $ POST'notinstring' and passed through sanitize text field — which strips HTML an...

CVE-2026-3079: Improper Neutralization of Special Elements used in an SQL Command

The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filtersorderbyorder' parameter in the 'learndashpropaneltemplate' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack o...

CVE-2026-3657: Improper Neutralization of Special Elements used in an SQL Command

The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the stickymenucontactleadform AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in $wpdb-insert. While...

Tarkov Data Manager SQL注入漏洞

Tarkov Data Manager is a database management tool from The Hideout open source. A SQL injection vulnerability exists in previous versions of Tarkov Data Manager 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, which stems from the presence of blind time-based SQL injection in the webhook editor and...

WordPress plugin VikRentCar Car Rental Management System SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL-based servers. A SQL injectio...

EUVD-2024-34358

Malicious code in bioql PyPI...

CVE-2025-61605 WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile_pet.php Endpoint

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identified in the /pet/profilepet.php endpoint, specifically in the idpet parameter. This vulnerability allows attackers to execute arbitrary SQL...

CVE-2025-61605

WeGIA contains an SQL Injection in version 3.4.12 and earlier, exploitable via the id_pet parameter in /pet/profile_pet.php. The root cause is improper handling of that parameter, allowing arbitrary SQL commands and compromising database confidentiality, integrity, and availability. A fix is avai...

CVE-2025-58454 WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'listar_despachos.php' parameter 'id_memorando'

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in WeGIA versions 3.4.10 and prior inthe endpoint /WeGIA/html/memorando/listardespachos.php, in the idmemorando parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL...

CVE-2025-58453 WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'exibe_anexo.php' parameter 'id_anexo'

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in WeGIA versions 3.4.10 and prior in the endpoint /WeGIA/html/memorando/exibeanexo.php, in the idanexo parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL queries,...

Mars: SQLi At `███████` via `theme_name`

A SQL injection vulnerability was discovered in a web application's theme selection endpoint through the "themename" parameter. Using SQLMap, the vulnerability was demonstrated to be exploitable through both error-based and time-based blind injection attacks against a MySQL database version 5.1 o...

📄 Campcodes Online Hospital Management System 1.0 SQL Injection

Campcodes Online Hospital Management System version 1.0 suffers from a remote SQL injection vulnerability. Exploit Title: Campcodes Online Hospital Management System 1.0 - SQL Injection Google Dork: N/A Exploit Author: Carine Constantino Vendor Homepage: https://www.campcodes.com Software Link:...

CVE-2025-30364 WeGIA vulnerable to SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionario

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/funcionario/remuneracao.php, in the idfuncionario parameter. This vulnerability allows the execution of arbitrary SQL commands, which can...

CVE-2025-22141 WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'

WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificarrecursoscargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity...

CVE-2024-11939: Improper Neutralization of Special Elements used in an SQL Command

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘data’ parameter in all versions up to, and including, 3.2.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

WordPress plugin Cost Calculator Builder PRO SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...