PT-2025-45420

Name of the Vulnerable Software and Affected Versions PaperWork versions 6.1.0.9390 through 6.1.0.9397 Description The software contains a flaw due to improper neutralization of special elements used in an SQL command, leading to a SQL injection issue. This impacts the application's ability to...

SourceCodester Best House Rental Management System SQL注入漏洞

SourceCodester Best House Rental Management System is a SourceCodester open source house rental management system. SourceCodester Best House Rental Management System version 1.0 has a SQL injection vulnerability, the vulnerability stems from the wrong operation of the parameter ID of the function...

PT-2025-45480

Name of the Vulnerable Software and Affected Versions SourceCodester PQMS version 1.0 Description A SQL injection issue exists in the Patient Queue Management System. The api patient schedule.php endpoint is affected because the appointmentID parameter does not receive proper sanitization,...

DedeBIZ 安全漏洞

DedeBIZ is a content management system from China Muyun Intelligence DedeBIZ company. A security vulnerability exists in DedeBIZ 6.3.2 and earlier versions, which stems from an incorrect manipulation of the parameter orderby in the file /admin/freelistmain.php, which could lead to a SQL injection...

Code-Projects Responsive Hotel Site 安全漏洞

Responsive Hotel Site is a responsive hotel website. Responsive Hotel Site suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter eid in the file /admin/newsletterdel.php. An attacker can exploit this...

SourceCodester PQMS 安全漏洞

SourceCodester PQMS is an open source product quality management system from SourceCodester. A security vulnerability exists in SourceCodester PQMS version 1.0, which stems from improper cleanup of the appointmentID parameter in the apipatientschedule.php endpoint, which could lead to the executi...

DedeBIZ 安全漏洞

DedeBIZ is a content management system from China Muyun Intelligence DedeBIZ company. A security vulnerability exists in DedeBIZ 6.3.2 and earlier versions, which stems from an incorrect manipulation of the parameter flags in the file /admin/specadd.php, which could lead to a SQL injection attack...

CampCodes School File Management SQL注入漏洞

CampCodes School File Management is a school file management system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes School File Management version 1.0, which stems from an incorrect manipulation of the parameter userid in the file /admin/updateuser.php, which could...

CVE-2025-34243

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2022-50594 Advantech iView < v5.7.04 Build 6425 data Parameter SQL Injection Information Disclosure

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘data’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitati...

CVE-2025-34245 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34243

Affected software: Advantech WebAccess/VPN before 1.1.5. Vulnerability: SQL injection in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated, low-privileged observer to inject SQL via datatable search parameters, leading to disclosure of database information. Impact (as ...

CVE-2025-34241 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34240 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34240

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection in AppManagementController.appUpgradeAction() due to failure to filter datatable search parameters. An authenticated, low-privileged observer can inject SQL to disclose database information. Affected software: Advantech WebAc...

CVE-2025-52773

CVE-2025-52773 affects the WordPress plugin HieCOR Payment Gateway Plugin (hcv4-payment-gateway)

CVE-2025-48089

CVE-2025-48089 is an SQL Injection vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy (histudy) affecting Education WordPress Theme | HiStudy versions from n/a through

EUVD-2025-37962

The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

Advantech WebAccess/VPN 安全漏洞

Advantech WebAccess/VPN is a virtual private network feature integrated in Advantech WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. Advantech WebAccess/VPN suffers from a SQL injection...

PT-2025-45366

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp config id’ parameter to the ‘NetworkServlet’ endpoint. Successful...