CVE-2025-52042

CVE-2025-52042 affects Frappe ERPNext 15.57.5. The vulnerable component is the function get_rfq_containing_supplier() in erpnext/buying/doctype/request_for_quotation/request_for_quotation.py, due to lack of validation of the txt parameter against externally entered SQL, enabling SQL Injection to ...

CVE-2025-52047

In Frappe ErpNext v15.57.5, the function getincomeaccount at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

CVE-2025-8121

Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability...

CVE-2025-8122 Blind SQL Injection in PAD CMS

Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability...

CVE-2025-8121

CVE-2025-8121 describes an input neutralization flaw that enables Blind SQL Injection in article positioning across templates www, bip, and ww+bip. The affected product is End-Of-Life, and no patches will be published by the vendor. The description does not provide concrete exploit vectors beyond...

CVE-2025-8121 Blind SQL Injection in PAD CMS

Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability...

CVE-2025-8877 AffiliateWP <= 2.28.2 - Unauthenticated SQL Injection

The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajaxgetaffiliateidfromlogin function in all versions up to, and including, 2.28.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-52047

In Frappe ErpNext v15.57.5, the function getincomeaccount at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that stems from the lack of validation of the importcoa function's company parameter against externally entered SQL statements. An attacker can exploit this...

PT-2025-39992

Name of the Vulnerable Software and Affected Versions Frappe ERPNext version 15.57.5 Description The get loyalty program details with points function located at erpnext/accounts/doctype/loyalty program/loyalty program.py is susceptible to SQL Injection. An attacker can inject a SQL query into the...

PT-2025-40010

Name of the Vulnerable Software and Affected Versions Karthikg1908 Hospital Management System HMS version 1.0 Description An SQL injection issue exists in the user-login.php and index.php files. The application does not properly sanitize input before using it in SQL queries. This allows remote...

Frappe Technologies Frappe 安全漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe version 15.57.5, which stems from insufficient validation of the expirydate parameter and...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the filters.disabled parameter of the getincomeaccount function. An attacker can...

PT-2025-39991

Name of the Vulnerable Software and Affected Versions Frappe ErpNext version 15.57.5 Description The get timesheet detail rate function located at erpnext/projects/doctype/timesheet/timesheet.py is susceptible to SQL Injection. This allows an attacker to extract information from databases by...

CVE-2025-57254

An SQL injection vulnerability affects Karthikg1908 Hospital Management System (HMS) 1.0, in user-login.php and index.php. The issue arises from improper input sanitization of username and password POST parameters, allowing remote attackers to execute arbitrary SQL queries. Consequences listed in...

CVE-2025-11109

A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/usedit.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is...

CVE-2025-11105

A flaw has been found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /schedulingsystem/addsubject.php. This manipulation of the argument subcode causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be...

CVE-2025-6724

CVE-2025-6724 affects Chef Automate on Linux x86, prior to 4.13.295, where an authenticated attacker can access restricted functionality in multiple services due to improperly neutralized inputs used in an SQL command. The root cause is input handling that enables SQL injection. Exploitation deta...

Simple Scheduling System add.home.php File SQL Injection Vulnerability

Simple Scheduling System is a simple scheduling system. Simple Scheduling System suffers from a SQL injection vulnerability that originates from not securely filtering the faculty parameter in the /add.home.php file. An attacker could exploit this vulnerability to obtain sensitive database...