CVE-2025-32968

XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend...

CVE-2025-32969

XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend,...

CVE-2025-32969 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend,...

CVE-2025-32968 org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend...

PT-2025-17644 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.8 through 15.10.15 XWiki versions 16.4.0 through 16.4.5 XWiki versions 16.10.0 through 16.10.0 Description: XWiki is a generic wiki platform. In the affected versions, it is possible for a remote unauthenticated user to escap...

The vulnerability of the software for managing and monitoring remote devices in telemetry and telemechanics systems, related to the lack of measures taken to protect the SQL query structure, allows a perpetrator to execute arbitrary SQL queries.

The vulnerability of software for managing and monitoring remote devices in telemetry and telemechanics systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2025-43949

MuM aka Mensch und Maschine MapEdit aka mapedit-web 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that control a web application's database server...

PT-2025-17581 · Mensch Und Maschine · Mum Mapedit

Name of the Vulnerable Software and Affected Versions: MuM aka Mensch und Maschine MapEdit aka mapedit-web version 24.2.3 Description: The issue allows an attacker to execute malicious SQL statements, controlling a web application's database server. This is due to a SQL Injection vulnerability...

CVE-2025-43949

MuM aka Mensch und Maschine MapEdit aka mapedit-web 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that control a web application's database server...

Siemens TeleControl Server Basic SQL Injection Vulnerability

TeleControl Server Basic is a server software for remote monitoring and control, widely used in industrial automation. Siemens TeleControl Server Basic suffers from a SQL injection vulnerability that stems from the internal use of the LockProjectCrossCommunications method that fails to properly...

PT-2025-17255 · Unknown · Pantherius Modal Survey

Name of the Vulnerable Software and Affected Versions: Pantherius Modal Survey versions through 2.0.2.0.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

CVE-2024-55238

OpenMetadata

PT-2025-16970 · Unknown · Cwd – Stealth Links

Name of the Vulnerable Software and Affected Versions: CWD – Stealth Links versions n/a through 1.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This allows for SQL Injection attacks. Recommendations:...

PT-2025-17149 · Unknown · Local Magic

Name of the Vulnerable Software and Affected Versions: Local Magic versions n/a through 2.6.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

CVE-2025-32859

The CVE-2025-32859 entry concerns Siemens TeleControl Server Basic prior to version V3.1.2.2, which is vulnerable to SQL injection via the internal LockWebServerGatewaySettings method. An authenticated attacker who can reach port 8000 can bypass authorization and read/write the application databa...

SQL Injection Vulnerability in NC Cloud of UFIDA Network Technology Co.

NC Cloud is a large enterprise digitalization platform that supports flexible deployment models of public, hybrid and proprietary clouds. A SQL injection vulnerability exists in NC Cloud of UFIDA Network Technology Corporation, which can be exploited by attackers to obtain sensitive information...

CVE-2025-32246 WordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database 1-click-backup-restore-database-by-sunbytes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1-Click Backup & Restore Database: from n/a through = 1.0.3...

CVE-2024-12410

The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

PT-2025-14917 · Silvasoft · Silvasoft Boekhouden

Name of the Vulnerable Software and Affected Versions: Silvasoft boekhouden versions n/a through 3.0.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

CVE-2025-31619

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows SQL Injection.This issue affects Actionwear products sync: from n/a through = 2.3.3...