30 matches found
CVE-2026-34099 Guardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.php
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in jobinfo.php line 16: SELECT FROM jobs where id = '".$GET'id'."'. No authentication is required. An unauthenticated attacker can perform error-based SQL injection to extract the database version, current...
WordPress plugin: Google Review Slider SQL injection vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...
CVE-2026-10260 CodeAstro Online Job Portal delete-jobs.php sql injection
A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now...
CVE-2018-25416
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the country parameter. Attackers can send GET requests to country.php with crafted SQL payloads in the country parameter to extrac...
CVE-2026-34788
Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tagmodel.php at line 168. The updateTagName function directly interpolates user input into the SQL query string without using parameterized queries or proper escapin...
CVE-2026-27743 SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection
The SPIP refererspam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the refererspamajouter and refererspamsupprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input...
OpenSky Flight Planning SQL Injection
The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the getdoc parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
Full Calendar Macro Extension SQL Injection
The vulnerability of the Full Calendar Macro extension of the XWiki platform relates to the lack of measures taken to protect the SQL query structure during the processing of the JSONService.xml page. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized acce...
EUVD-2024-1009
Malicious code in bioql PyPI...
FortiManager FortiAnalyzer SQL Injection Information Disclosure
The vulnerability of the software solutions for centralized device management of Fortinet’s FortiManager and FortiManager Cloud, as well as the security event monitoring and analysis solutions of FortiAnalyzer and FortiAnalyzer Cloud, is related to the lack of protective measures for the SQL quer...
Zoho ManageEngine ADAudit Plus Unauthorized Access
The vulnerability of the “Service Account Audit Data” component of the Windows Active Directory AD management and reporting software Zoho ManageEngine ADAudit Plus is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow an attacker,...
WordPress Hero Slider plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Lucio Sá in WordPress Plugin Hero Slider versions = 1.3.5...
WordPress Bit Assist plugin <= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id Parameter vulnerability
Authenticated Subscriber+ SQL Injection via id Parameter vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Bit Assist versions = 1.5.2...
SolarWinds Platform SQL Injection
The vulnerability of the software for network monitoring and control of IT infrastructure on the SolarWinds Platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...
WP Sessions Time Monitoring Plugin Protected Information Disclosure
The vulnerability of the WP Sessions Time Monitoring full-automatic content management system’s plugin is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to disclose the protected information...
CVE-2024-0460
A vulnerability was found in code-projects Faculty Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/pages/student-print.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed...
SourceCodester E-Commerce System setDiscount.php Data Compromise
The vulnerability in the ecommerce/admin/settings/setDiscount.php file of the SourceCodester E-Commerce System is related to the lack of protection for SQL query structures. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of th...
CVE-2022-36696
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletestockout...