CVE-2025-11037

A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/adminindexsearch.php. Performing manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit has been released to th...

CVE-2025-11033

The CVE-2025-11033 entry concerns kidaze CourseSelectionSystem and a SQL injection in an unknown function of /Profilers/PriProfile/COUNT3s7.php via the cbe parameter. Remote exploitation is possible, and exploits have been disclosed publicly. Multiple feeds confirm impact is related to SQL inject...

CVE-2025-60108

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a...

CVE-2025-60110 WordPress AllInOne - Banner Rotator Plugin <= 3.8 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows SQL Injection.This issue affects AllInOne - Banner Rotator: from n/a through = 3.8...

CVE-2025-60109 WordPress LambertGroup - AllInOne - Content Slider Plugin <= 3.8 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through = 3.8...

PT-2025-39496

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU plugin for WordPress versions through 5.2.7 Description The Featured Image from URL FIFU plugin for WordPress is susceptible to SQL Injection through the get all urls function. Insufficient escaping of user-supplie...

📄 JS Archive List 6.1.5 SQL Injection

JS Archive List versions 6.1.5 and below suffer from a remote SQL injection vulnerability. CVE-2025-54726 JS Archive List = 6.1.5 - Unauthenticated SQL Injection Description The JS Archive List plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.1.5 due to...

Code-Projects E-Commerce Website SQL Injection Vulnerabilities

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Search in the file /pages/adminindexsearch.php. An attacker can exploit this vulnerability t...

WordPress plugin LambertGroup AllInOne Banner has a SQL injection vulnerability in its playlist functionality.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...

WordPress Plugin AllInOne – Banner Rotator SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. WordPress plugin AllInOne - Banner Rotator suffers from a SQL injection vulnerability, no detai...

WordPress plugin: Featured Image from URL SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...

Itsourcecode Open Source Job Portal SQL Injection Vulnerability

itsourcecode Open Source Job Portal is itsourcecode open source an enterprise portal site . A SQL injection vulnerability exists in version 1.0 of itsourcecode Open Source Job Portal, which stems from incorrect manipulation of the parameter ID in the file /admin/user/index.php, which could lead t...

Itsourcecode Online Clinic Management System SQL Injection Vulnerability

itsourcecode Online Clinic Management System is an online clinic management system of itsourcecode open source. A SQL injection vulnerability exists in version 1.0 of itsourcecode Online Clinic Management System, which stems from an incorrect manipulation of the parameter ID in the file...

PT-2025-39680

Name of the Vulnerable Software and Affected Versions Campcodes Computer Sales and Inventory System version 1.0 Description A security issue exists in Campcodes Computer Sales and Inventory System 1.0. The vulnerability is related to the manipulation of the ID argument within the file '/pages/us...

PT-2025-39557

Name of the Vulnerable Software and Affected Versions LambertGroup AllInOne - Banner Rotator versions through 3.8 Description The software contains a flaw due to improper neutralization of special elements within SQL commands, leading to a SQL Injection issue. This allows for potential manipulati...

CVE-2025-10967 MuFen-mker PHP-Usermm chkuser.php sql injection

A vulnerability was detected in MuFen-mker PHP-Usermm up to 37f2d24e51b04346dfc565b93fc2fc6b37bdaea9. This affects an unknown part of the file /chkuser.php. Performing manipulation of the argument Username results in sql injection. The attack may be initiated remotely. The exploit is now public a...

CVE-2025-59816 Authenticated Union based SQL-injection in the search input field

This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue...

CVE-2025-59816

CVE-2025-59816 affects Zenitel ICX500/ICX510 Billing Admin endpoint. Affects the Billing Admin component where attackers can query the underlying database directly, potentially retrieving all data including plaintext passwords. Root cause: database query exposure via the Billing Admin interface. ...

CVE-2025-27261

Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data...

CVE-2025-40698 SQL injection vulnerability in Prevengos

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in...