8925 matches found
CVE-2025-52042
In Frappe ERPNext 15.57.5, the function getrfqcontainingsupplier at erpnext/buying/doctype/requestforquotation/requestforquotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter...
BIT-GITLAB-2025-10867 Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests...
CVE-2025-6724
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command...
NVIDIA Delegated Licensing Service security vulnerabilities
NVIDIA Delegated Licensing Service is a licensing service from NVIDIA Corporation. A security vulnerability exists in NVIDIA Delegated Licensing Service, which stems from vulnerability to SQL injection attacks that could lead to a partial denial of service...
PT-2025-39990
Name of the Vulnerable Software and Affected Versions Frappe ErpNext version 15.57.5 Description The get income account function at erpnext/controllers/queries.py is susceptible to SQL Injection. An attacker can inject a SQL query into the filters.disabled parameter, potentially allowing extracti...
CVE-2024-13150
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection. This issue affects fayton.Pro ERP: through 20250929...
CVE-2025-6724
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command...
CVE-2025-8868
Chef Automate is affected by CVE-2025-8868 for versions earlier than 4.13.295 on Linux x86. An authenticated attacker can access restricted functionality in the compliance service through SQL injection caused by improperly neutralized inputs using a well-known token. The NVD/NIST entry indicates ...
CVE-2025-11052
A security flaw has been discovered in kidaze CourseSelectionSystem 1.0/5.php. The impacted element is an unknown function of the file /Profilers/PriProfile/COUNT3s5.php. Performing manipulation of the argument csslc results in sql injection. The attack can be initiated remotely. The exploit has...
Zenitel ICX500/ICX510 SQL Injection
The vulnerability of the microprogramming-based switching software of Zenitel ICX500 and ICX510 lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the Billing Admin database...
PT-2025-39826
Name of the Vulnerable Software and Affected Versions fayton.Pro ERP versions through 20250929 Description A flaw exists in fayton.Pro ERP that allows for SQL Injection. This issue enables unauthorized access to the full database with minimal effort. The vulnerability is due to improper...
Fayton fayton.pro ERP SQL injection vulnerability
Fayton fayton.pro ERP is an enterprise resource planning system from Fayton, Turkey. A SQL injection vulnerability exists in Fayton fayton.pro ERP 20250929 and earlier versions, which stems from improper neutralization of special elements and can lead to SQL injection attacks...
PT-2025-39823
Name of the Vulnerable Software and Affected Versions Chef Automate versions prior to 4.13.295 Description Chef Automate versions earlier than 4.13.295 on Linux x86 are susceptible to a condition where an authenticated attacker can access restricted functionality. This is due to improperly...
CVE-2025-11115
CVE-2025-11115 affects Code-Projects Simple Scheduling System 1.0, with the flaw located in addtime.php where manipulating starttime/endtime triggers SQL injection. Remote exploitation is possible and public exploits have been disclosed. Multiple sources (NVD/NVDC/CNVD/Red Hat feed) corroborate t...
CVE-2025-11114 CodeAstro Online Leave Application leaveAplicationForm.php sql injection
A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.php. Executing manipulation of the argument absence can lead to sql injection. The attack may be launched remotely. The exploit has been...
CVE-2025-11113
CVE-2025-11113 affects CodeAstro Online Leave Application 1.0. The vulnerability is in /signup.php, where manipulating the city parameter results in SQL injection. The attack can be performed remotely and public exploits are known. Other parameters may also be affected. Several connected sources ...
CVE-2025-11109 Campcodes Computer Sales and Inventory System us_edit.php sql injection
A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/usedit.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is...
CVE-2025-11104
A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /admin/bill.php. The manipulation of the argument uid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
CVE-2025-11102
A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/editcontent.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be launched remotely. The exploit has been made available t...
CVE-2025-11102 Campcodes Online Learning Management System edit_content.php sql injection
A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/editcontent.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be launched remotely. The exploit has been made available t...