PT-2025-17644 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.8 through 15.10.15 XWiki versions 16.4.0 through 16.4.5 XWiki versions 16.10.0 through 16.10.0 Description: XWiki is a generic wiki platform. In the affected versions, it is possible for a remote unauthenticated user to escap...

The vulnerability of the software for managing and monitoring remote devices in telemetry and telemechanics systems, related to the lack of measures taken to protect the SQL query structure, allows a perpetrator to execute arbitrary SQL queries.

The vulnerability of software for managing and monitoring remote devices in telemetry and telemechanics systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2025-43949

MuM aka Mensch und Maschine MapEdit aka mapedit-web 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that control a web application's database server...

PT-2025-17581 · Mensch Und Maschine · Mum Mapedit

Name of the Vulnerable Software and Affected Versions: MuM aka Mensch und Maschine MapEdit aka mapedit-web version 24.2.3 Description: The issue allows an attacker to execute malicious SQL statements, controlling a web application's database server. This is due to a SQL Injection vulnerability...

CVE-2025-43949

MuM aka Mensch und Maschine MapEdit aka mapedit-web 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that control a web application's database server...

Siemens TeleControl Server Basic SQL Injection Vulnerability

TeleControl Server Basic is a server software for remote monitoring and control, widely used in industrial automation. Siemens TeleControl Server Basic suffers from a SQL injection vulnerability that stems from the internal use of the LockProjectCrossCommunications method that fails to properly...

PT-2025-17255 · Unknown · Pantherius Modal Survey

Name of the Vulnerable Software and Affected Versions: Pantherius Modal Survey versions through 2.0.2.0.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

CVE-2024-55238

OpenMetadata

PT-2025-16970 · Unknown · Cwd – Stealth Links

Name of the Vulnerable Software and Affected Versions: CWD – Stealth Links versions n/a through 1.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This allows for SQL Injection attacks. Recommendations:...

PT-2025-17149 · Unknown · Local Magic

Name of the Vulnerable Software and Affected Versions: Local Magic versions n/a through 2.6.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

CVE-2025-32859

The CVE-2025-32859 entry concerns Siemens TeleControl Server Basic prior to version V3.1.2.2, which is vulnerable to SQL injection via the internal LockWebServerGatewaySettings method. An authenticated attacker who can reach port 8000 can bypass authorization and read/write the application databa...

SQL Injection Vulnerability in NC Cloud of UFIDA Network Technology Co.

NC Cloud is a large enterprise digitalization platform that supports flexible deployment models of public, hybrid and proprietary clouds. A SQL injection vulnerability exists in NC Cloud of UFIDA Network Technology Corporation, which can be exploited by attackers to obtain sensitive information...

CVE-2025-32246 WordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database 1-click-backup-restore-database-by-sunbytes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1-Click Backup & Restore Database: from n/a through = 1.0.3...

CVE-2024-12410

The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

PT-2025-14917 · Silvasoft · Silvasoft Boekhouden

Name of the Vulnerable Software and Affected Versions: Silvasoft boekhouden versions n/a through 3.0.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

CVE-2025-31619

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows SQL Injection.This issue affects Actionwear products sync: from n/a through = 2.3.3...

BIT-DOLIBARR-2024-5315 Multiple vulnerabilities in DOLIBARR's ERP CMS

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in...

PT-2025-14755 · Unknown · Social Share/Social Locker

Name of the Vulnerable Software and Affected Versions: Social Share And Social Locker versions 1.4.2 and earlier Description: The issue is related to improper neutralization of special elements used in SQL commands, allowing Blind SQL Injection. This can be exploited due to the improper handling ...

Payroll Management System SQL Injection Vulnerability (CNVD-2025-06475)

Payroll Management System is a payroll management system. A SQL injection vulnerability exists in Payroll Management System version 1.0 due to a lack of validation of externally entered SQL statements in the parameter emptype. An attacker can exploit this vulnerability to execute illegal SQL...

AppSmith 1.47 - Remote Code Execution (RCE)

Exploit Title: AppSmith 1.47 - Remote Code Execution RCE Original Author: Rhino Security Labs Exploit Author: Nishanth Anand Exploit Date: April 2, 2025 Vendor Homepage: https://www.appsmith.com/ Software Link: https://github.com/appsmithorg/appsmith Version: Prior to v1.52 Tested Versions: v1.47...