QNAP Qsync Central SQL注入漏洞

QNAP Qsync Central is a private cloud synchronization service launched by QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices. A SQL injection vulnerability exists in QNAP Qsync Central, which can be exploited by attackers to execute unauthorized co...

WordPress plugin Simple Download Monitor SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PHPGurukul Hospital Management System 安全漏洞

Hospital Management System is a PHP and MySQL based hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally-entered SQL statements in the pagetitle parameter of about-us.php. An attacker can exploit thi...

CVE-2025-51825

CVE-2025-51825 applies to JeecgBoot versions 3.4.3 through 3.8.0. A SQL injection vulnerability exists in the endpoint /jeecg-boot/online/cgreport/head/parseSql that allows bypassing SQL blacklist restrictions. The incident is documented across multiple feeds (NVD, Red Hat, GHSA, osv, etc.). Impa...

GHSA-PWH4-6R3M-J2RF PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

Summary The parameter addlinks in the API /json/addpackage is vulnerable to SQL Injection. SQL injection vulnerabilities can lead to sensitive data leakage. Details - Affected file：https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/filedatabase.pyL271 - Affected code: python...

PT-2025-32773 · Microsoft · Sql Server

Name of the Vulnerable Software and Affected Versions: SQL Server affected versions not specified Description: The software contains an improper neutralization of special elements used in an SQL command, leading to a potential SQL injection issue. This allows an authorized attacker to elevate...

Exam Form Submission update_s5.php file SQL injection vulnerability

Exam Form Submission is an exam form. Exam Form Submission suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter credits in file /admin/updates5.php. An attacker can exploit this vulnerability to execute illegal SQL...

Microsoft 365 Copilot BizChat 命令注入漏洞

Microsoft 365 Copilot BizChat is an AI chat software from Microsoft Corporation USA. Microsoft 365 Copilot BizChat suffers from a command injection vulnerability that stems from improper neutralization of special elements used in commands. An attacker exploiting the vulnerability could gain acces...

The ADOdb sqlite3 driver allows SQL injection

Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database and calls the metaColumns, metaForeignKeys or metaIndexes methods with a crafted table name. Note that the indicated Severity corresponds to a...

SQL Injection

Overview bacula-web/bacula-web is a The open source web based reporting and monitoring tool for Bacula. Affected versions of this package are vulnerable to SQL Injection via the getJobFiles function in the application/Table/JobFileTable.php . An attacker can execute arbitrary code on the server b...

PT-2025-30959 · Phpgurukul · Phpgurukul Local Services Search Engine Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Local Services Search Engine Management System version 2.1 Description: A critical vulnerability exists in PHPGurukul Local Services Search Engine Management System 2.1. The vulnerability is due to a SQL injection within an unknown...

SAMSUNG MagicINFO 9 Server 安全漏洞

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. SAMSUNG MagicINFO 9 Server suffers from a code injection vulnerability that originates from improper code generation control and can be exploited by an attacker ...

PT-2025-30235 · Simopro Technology · Winmatrix3 Web

Name of the Vulnerable Software and Affected Versions: WinMatrix3 Web package versions affected versions not specified Description: WinMatrix3 Web package developed by Simopro Technology contains a SQL Injection flaw. This allows unauthenticated remote attackers to inject arbitrary SQL commands,...

CVE-2025-47645

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue affects ELEX WooCommer...

PT-2025-29827

Name of the Vulnerable Software and Affected Versions Vue I18n versions 9.0.0 through 9.14.4 Vue I18n versions 10.0.0 through 10.0.7 Vue I18n versions 11.0.0 through 11.0.9 Description Vue I18n, an internationalization plugin for Vue.js, contains a flaw in the escapeParameterHtml: true option. Th...

PT-2025-29811 · Unknown · Shinetheme Traveler

Name of the Vulnerable Software and Affected Versions: shinetheme Traveler affected versions not specified Description: The software contains a SQL injection flaw due to improper neutralization of special elements used in an SQL command. This allows for potential SQL injection attacks...

PT-2025-29330 · Phpgurukul · Phpgurukul Vehicle Parking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Vehicle Parking Management System version 1.13 Description: A critical vulnerability exists in PHPGurukul Vehicle Parking Management System 1.13. The vulnerability is due to a SQL injection flaw within the /users/view--detail.php...

PHPGurukul Zoo Management System 安全漏洞

Zoo Management System is a zoo management system. Zoo Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter Username in file /admin/index.php. An attacker can exploit this vulnerability to...

CampCodes Advanced Online Voting System 注入漏洞

CampCodes Advanced Online Voting System is an advanced online voting system from CampCodes, Inc. An injection vulnerability exists in Campcodes Advanced Online Voting System version 1.0, which stems from improper handling of the parameter Username in the file /users/index.php, which could lead to...

ESPAsyncWebServer 注入漏洞

ESPAsyncWebServer is an asynchronous web server from the ESP32 Asynchronous Networking community for microcontrollers such as the ESP8266 and ESP32. An injection vulnerability exists in ESPAsyncWebServer version 3.7.8 and earlier, which stems from a CRLF injection in the HTTP header construction...