CVE-2025-9678

A weakness has been identified in Campcodes Online Loan Management System 1.0. The impacted element is an unknown function of the file /ajax.php?action=deleteborrower. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-29894

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 2025/04/23...

CVE-2025-9665

The CVE covers code-projects Simple Grading System 1.0, where the Admin Panel’s /edit_student.php contains a vulnerability in the ID parameter that allows SQL injection. This is exploitable remotely, with public exploit material available. Affected component is the Admin Panel through an unknown ...

CVE-2025-9663

A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /editaccount.php of the component Admin Panel. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicl...

CVE-2025-9663 code-projects Simple Grading System Admin Panel edit_account.php sql injection

A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /editaccount.php of the component Admin Panel. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicl...

CVE-2025-9662 code-projects Simple Grading System Admin Panel login.php sql injection

A vulnerability was determined in code-projects Simple Grading System 1.0. This affects an unknown function of the file /login.php of the component Admin Panel. Executing manipulation can lead to sql injection. The attack may be performed from a remote location. The exploit has been publicly...

CVE-2025-9645 itsourcecode Apartment Management System r_all_info.php sql injection

A vulnerability was identified in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /tdashboard/rallinfo.php. The manipulation of the argument mid leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2025-9608

Portabilis i-Educar up to version 2.10 is affected. The vulnerability resides in the Formula de Cálculo de Média Page, specifically the /module/FormulaMedia/view file, where manipulating the ID parameter leads to SQL injection. Remote exploitation is possible, and public exploits/POCs have been d...

Jinher OA security vulnerabilities

Jinher OA is a collaborative management software from Jinher, China. A security vulnerability exists in Jinher OA version 1.0, which originates from improper manipulation of the parameter ID in the file GetTreeDate.aspx, which may lead to an SQL injection attack...

ABC Courier Management System SQL Injection

The vulnerability of the ABC Courier Management System project management software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

CGM CLININET SQL Injection Vulnerability (CNVD-2025-19810)

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from a SQL injection vulnerability that originates from the lack of validation of the UserID parameter of the getUserInfo function against external input SQL statements. An attacker can exploit this...

CGM CLININET SQL Injection Vulnerability (CNVD-2025-19811)

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the UserID parameter of the OpenReportWindow.pl file. An attacker can exploit this...

CGM CLININET SQL Injection Vulnerability (CNVD-2025-19809)

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the getPerfServiceIds function. An attacker can exploit this vulnerability to...

PT-2025-35177

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A vulnerability exists in Portabilis i-Educar up to version 2.10, specifically within the /module/FormulaMedia/view file of the Formula de Cálculo de Média Page component. Manipulation of t...

QNAP Qsync Central SQL Injection Vulnerability

QNAP Qsync Central is a private cloud synchronization service launched by QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices. QNAP Qsync Central suffers from a SQL injection vulnerability that stems from the application's lack of validation of...

SQL Injection Vulnerability in Clinic Image System

Changing Clinic Image System is a computer system for managing and displaying medical images from Changing Taiwan, China. The Changing Clinic Image System suffers from a SQL injection vulnerability that stems from susceptibility to SQL injection attacks, which could lead to an unauthenticated...

Code-Projects Simple Grading System Security Vulnerabilities

Simple Grading System is a simple grading system. Simple Grading System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter ID of the file /editstudent.php. An attacker can exploit this vulnerability to execute...

i-Educar security vulnerabilities

i-Educar is a free educational software from Portábilis Open Source. A security vulnerability exists in i-Educar version 2.10 and earlier, which stems from a SQL injection attack due to a mishandling of the parameter ID in the file /module/FormulaMedia/view...

WordPress plugin iATS Online Forms has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A SQL injection vulnerability exists in the WordPress iATS Online Forms plugin, which stems from a temporal SQL injection in the parameter order, which can be exploited by an...

PT-2025-35175

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar versions prior to 2.11 Description A SQL injection issue exists in an unknown functionality of the file /intranet/agenda preferencias.php. Manipulation of the cod agenda argument can trigger the issue. The attack can be...