PT-2025-10057

Name of the Vulnerable Software and Affected Versions School Management System for Wordpress plugin versions up to, and including, 92.0.0 Description The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the mj...

PT-2025-10056

Name of the Vulnerable Software and Affected Versions School Management System for Wordpress plugin versions up to, and including, 92.0.0 Description The issue allows authenticated attackers with Custom-level access and above to perform SQL Injection via the id parameter of the "mj smgt show even...

CVE-2024-13809: Improper Neutralization of Special Elements used in an SQL Command

The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2025-9808

Name of the Vulnerable Software and Affected Versions The Hero Mega Menu - Responsive WordPress Menu Plugin versions up to, and including, 1.16.5 Description The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query,...

SQL Injection Vulnerability in NetDrive Unified Communication Platform of Beijing NetDrive Network Technology Co.

Ltd. is a leading global provider of cloud video solutions and services. A SQL injection vulnerability exists in the NetDrive Unified Communications Platform of Beijing NetDrive Network Technology Co., Ltd, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Founder Unlimited Media News Editorial System of Beijing Beifang Founder Electronics Co.

Beijing Beifang Founder Electronics Co., Ltd. is a leading technology and service provider in the fields of printing, media, publishing, and font libraries. A SQL injection vulnerability exists in Beijing Founder Electronics Co., Ltd.'s Founder Unlimited All-Media News Gathering and Editing Syste...

CVE-2025-1726 [#BUG-000172669 ArcGIS Monitor has a security vulnerability]

There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some...

SQL Injection Vulnerability in UFIDA NC of UFIDA Network Technology Co.

UFIDA NC is a comprehensive business management software for large enterprises. A SQL injection vulnerability exists in UFIDA NC, which can be exploited by attackers to obtain sensitive database information...

PT-2025-7362

Name of the Vulnerable Software and Affected Versions LTL Freight Quotes – Old Dominion Edition plugin for WordPress versions up to, and including, 4.2.10 Description The issue is related to SQL Injection via the edit id and dropship edit id parameters due to insufficient escaping on the user...

CVE-2025-25222

CVE-2025-25222 affects LuxCal Web Calendar. Multiple connected sources confirm an SQL injection vulnerability in retrieve.php present in LuxCal versions prior to 5.3.3M (MySQL) and prior to 5.3.3L (SQLite). Root cause: unsafely constructed SQL in retrieve.php allows unauthorized access to databas...

CVE-2025-25221

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

CVE-2025-0821: Improper Neutralization of Special Elements used in an SQL Command

Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-35548

A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications...

CVE-2025-1144

School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials...

CVE-2024-13473

The LTL Freight Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameter in all versions up to, and including, 5.0.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

WordPress plugin Small Package Quotes SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

CVE-2024-13490: Improper Neutralization of Special Elements used in an SQL Command

The LTL Freight Quotes – XPO Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 4.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2025-1144: Exposure of Sensitive System Information to an Unauthorized Control Sphere

School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials...

PT-2025-6146 · Unknown · Quanxun School Affairs System

Name of the Vulnerable Software and Affected Versions: Quanxun School Affairs System affected versions not specified Description: The issue allows unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials. This exposure of...

CVE-2024-29723

SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/conexiones/ax/openTracExt/, parameter...