📄 HighPortal 12.x SQL Injection

HighPortal version 12.x remote SQL injection proof of concept exploit. ============================================================================================================================================= | Title : HighPortal v12.x SQL Injection Exploit | | Author : indoushka | | Tested o...

PT-2025-51841

Name of the Vulnerable Software and Affected Versions ITSourcecode COVID Tracking System Using QR-Code version 1.0 Description A SQL injection issue exists in the '/cts/admin/?page=zone' file. The issue occurs because malicious code can be injected through the id parameter and directly used in SQ...

CVE-2025-67285

A SQL injection vulnerability exists in ITSourcecode COVID Tracking System Using QR-Code v1.0 within the /cts/admin/?page=zone file. The root cause is the lack of proper sanitization or validation for the id parameter, which allows attackers to inject malicious code directly into SQL queries. Evi...

PT-2025-51972

Name of the Vulnerable Software and Affected Versions code-projects Online Appointment Booking System version 1.0 Description A security flaw exists in code-projects Online Appointment Booking System 1.0. The issue involves SQL injection resulting from manipulation of the clinic argument within t...

PT-2025-51978

Name of the Vulnerable Software and Affected Versions code-projects Simple Stock System version 1.0 Description A weakness exists in code-projects Simple Stock System 1.0. This issue affects an unknown function within the /checkuser.php file. Manipulation of the Username argument can lead to SQL...

EUVD-2025-203642

A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dishtradedetailget. The manipulation of the argument filter results in sql injection. The attack can be executed remotely. The exploit is now...

CVE-2025-14780 Xiongwei Smart Catering Cloud Platform dish_trade_detail_get sql injection

A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dishtradedetailget. The manipulation of the argument filter results in sql injection. The attack can be executed remotely. The exploit is now...

EUVD-2025-203551

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup LBG Zoominoutslider lbgzoominoutslider allows SQL Injection.This issue affects LBG Zoominoutslider: from n/a through = 5.4.5...

CVE-2025-67999

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Injection.This issue affects Newsletter: from n/a through = 9.0.9...

CVE-2025-68056 WordPress LBG Zoominoutslider plugin <= 5.4.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup LBG Zoominoutslider lbgzoominoutslider allows SQL Injection.This issue affects LBG Zoominoutslider: from n/a through = 5.4.4...

CVE-2025-68055

CVE-2025-68055 - WordPress Hydra Booking plugin

CVE-2025-68054 WordPress CountDown With Image or Video Background plugin <= 1.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup CountDown With Image or Video Background countdownwithbackground allows Blind SQL Injection.This issue affects CountDown With Image or Video Background: from n/a through = 1.5...

CVE-2025-67999

Technical details for CVE-2025-67999 are not provided in the supplied documents. Monitor for updates; the materials do not specify affected product versions, impact, or remediation.

CVE-2025-67950

CVE-2025-67950 affects the WordPress All In One SEO Pack plugin (versions up to 4.9.1). The Red Hat/NVD/Patchstack entries describe an SQL injection vulnerability due to improper input handling that enables blind SQL injection with authenticated access (Contributor+) and high impact (C/H/I/H/A). ...

CVE-2025-67751

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

EUVD-2025-203486

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

CVE-2025-66440

An issue was discovered in Frappe ERPNext through 15.89.0. Function getoutstandingreferencedocuments at erpnext/accounts/doctype/paymententry/paymententry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the...

CVE-2025-67736

The FreePBX module tts Text to Speech for FreePBX, an open-source web-based graphical user interface GUI that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to t...

EUVD-2025-203481

The FreePBX module tts Text to Speech for FreePBX, an open-source web-based graphical user interface GUI that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to t...

PT-2025-51447

Name of the Vulnerable Software and Affected Versions LambertGroup LBG Zoominoutslider versions through 5.4.5 Description A flaw exists in LambertGroup LBG Zoominoutslider that allows for SQL Injection. This occurs due to improper neutralization of special elements used in an SQL command. The iss...