CVE-2025-14169

The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

SQL Injection

nukeviet/nukeviet is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the topicsid parameter in modules/news/admin/addtotopics.php, which allows an attacker to execute malicious SQL queries through crafted input...

SQL Injection

io.dataease, dataease-plugin-common is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the dataSourceId parameter, which allows an attacker to inject and execute arbitrary SQL queries...

Exploit for CVE-2025-66947

CVE-2025-66947 SQL Injection in krishanmuraiji SMS v1.0 CVE-2...

CVE-2025-13089

CVE-2025-13089 (WP Directory Kit) : WordPress plugin is vulnerable to unauthenticated SQL Injection via parameters hide_fields and attr_search in all versions up to 1.4.7 due to insufficient escaping and lack of prepared statements. Exploitation could allow an attacker to append SQL to existing q...

CVE-2025-13089 WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection

The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hidefields' and the 'attrsearch' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2025-203175

A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=zone. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and...

WordPress plugin Design Import/Export SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...

PT-2025-51090

Name of the Vulnerable Software and Affected Versions URL Shortener Plugin For WordPress versions through 3.0.7 Description The URL Shortener Plugin For WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the analytic id parameter is n...

PT-2025-51114

Name of the Vulnerable Software and Affected Versions code-projects Prison Management System version 2.0 Description A security issue exists in code-projects Prison Management System 2.0. The vulnerability is due to the manipulation of the keyname argument in the file '/admin/search1.php', which...

PT-2025-51129

Name of the Vulnerable Software and Affected Versions Student File Management System version 1.0 Description A flaw exists in Student File Management System version 1.0 where manipulation of the user id argument in the file '/admin/update user.php' can lead to SQL injection. Remote exploitation i...

itsourcecode Online Pet Shop Management System SQL注入漏洞

itsourcecode Online Pet Shop Management System is itsourcecode open source online pet store management system. The SQL injection vulnerability exists in itsourcecode Online Pet Shop Management System version 1.0, which originates from the incorrect operation of the parameter cnpname in the file...

CVE-2025-14585 itsourcecode COVID Tracking System page sql injection

A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=zone. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and...

CVE-2025-14584 itsourcecode COVID Tracking System Admin Login login.php sql injection

A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclos...

CVE-2024-58309

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database...

CVE-2024-58301

Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially...

WordPress 404 Solution plugin <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter vulnerability

Authenticated Admin+ SQL Injection via 'filterText' Parameter vulnerability discovered by Muhamad Visat in WordPress Plugin 404 Solution versions = 3.1.0...

EUVD-2025-203109

A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employeeid/id/admin leads to sql injection. The attack can be initiated...

EUVD-2025-203122

A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewadmin.php. This manipulation of the argument adminid causes sql injection. The attack may be initiated remotely. The exploit has been publishe...

CVE-2025-14578

A weakness has been identified in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /updateaccount.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available ...