PT-2025-39496

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU plugin for WordPress versions through 5.2.7 Description The Featured Image from URL FIFU plugin for WordPress is susceptible to SQL Injection through the get all urls function. Insufficient escaping of user-supplie...

Code-Projects E-Commerce Website SQL注入漏洞

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Search in the file /pages/adminindexsearch.php. An attacker can exploit this vulnerability t...

WordPress plugin AllInOne - Banner Rotator SQL注入漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. WordPress plugin AllInOne - Banner Rotator suffers from a SQL injection vulnerability, no detai...

PT-2025-39557

Name of the Vulnerable Software and Affected Versions LambertGroup AllInOne - Banner Rotator versions through 3.8 Description The software contains a flaw due to improper neutralization of special elements within SQL commands, leading to a SQL Injection issue. This allows for potential manipulati...

itsourcecode Open Source Job Portal SQL注入漏洞

itsourcecode Open Source Job Portal is itsourcecode open source an enterprise portal site . A SQL injection vulnerability exists in version 1.0 of itsourcecode Open Source Job Portal, which stems from incorrect manipulation of the parameter ID in the file /admin/user/index.php, which could lead t...

WordPress plugin LambertGroup AllInOne Banner with Playlist SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...

📄 JS Archive List 6.1.5 SQL Injection

JS Archive List versions 6.1.5 and below suffer from a remote SQL injection vulnerability. CVE-2025-54726 JS Archive List = 6.1.5 - Unauthenticated SQL Injection Description The JS Archive List plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.1.5 due to...

CVE-2025-10967 MuFen-mker PHP-Usermm chkuser.php sql injection

A vulnerability was detected in MuFen-mker PHP-Usermm up to 37f2d24e51b04346dfc565b93fc2fc6b37bdaea9. This affects an unknown part of the file /chkuser.php. Performing manipulation of the argument Username results in sql injection. The attack may be initiated remotely. The exploit is now public a...

CVE-2025-59816 Authenticated Union based SQL-injection in the search input field

This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue...

CVE-2025-59816

CVE-2025-59816 affects Zenitel ICX500/ICX510 Billing Admin endpoint. Affects the Billing Admin component where attackers can query the underlying database directly, potentially retrieving all data including plaintext passwords. Root cause: database query exposure via the Billing Admin interface. ...

CVE-2025-27261

Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data...

CVE-2025-40698 SQL injection vulnerability in Prevengos

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in...

CVE-2025-10825

A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. Affected is an unknown function of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack can be initiated remotely. The exploit is publicly available...

CVE-2025-10840

A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/print-payment.php. This manipulation of the argument sql111 causes sql injection. The attack can be initiated remotely. The exploit has been made available to...

CVE-2025-10834

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available a...

PT-2025-39456

Name of the Vulnerable Software and Affected Versions JackieDYH Resume-management-system versions prior to fb6b857d852dd796e748ce30c606fe5e61c18273 Description A flaw exists in JackieDYH Resume-management-system that allows for SQL injection through manipulation of the userid argument in the...

Park Ticketing Management System normal-bwdates-reports-details.php file SQL injection vulnerability

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally-entered SQL statements in the parameter fromdate in the file normal-bwdates-reports-details.php. A...

Hostel Management System log_email Parameter SQL Injection Vulnerability

Hostel Management System is a hostel management system. Hostel Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter logemail in the file /justines/index.php. An attacker can exploit this...

Online Bidding System remove.php File SQL Injection Vulnerability

Online Bidding System is an online bidding system. Online Bidding System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter ID of the file /administrator/remove.php. An attacker can exploit this vulnerability ...

Hostel Management System ID Parameter SQL Injection Vulnerability

Hostel Management System is a hostel management system. Hostel Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in parameter ID in file /justines/admin/modreservation/index.php?view=view. An attacker can...