3285 matches found
EUVD-2025-210535
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...
PT-2026-66589
Name of the Vulnerable Software and Affected Versions SourceCodester Tailor Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs at the 'customeredit.php' endpoint...
PT-2026-66585
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit member.php?id=1...
EUVD-2025-210552
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edittype.php endpoint via the Parameter id...
CVE-2025-69941
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...
CVE-2025-69933
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1...
EUVD-2025-210563
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...
mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...
EUVD-2026-50494
DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...
CVE-2026-12895 SQL Injection in Frappe's ERPNext
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...
CVE-2026-12895
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...
CVE-2026-63233
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
EUVD-2026-50109
The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
PT-2026-65787
A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...
CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...
CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...
CVE-2026-11391
CVE-2026-11391 involves a SQL injection vulnerability in Tanium’s Patch module. The connected documents confirm Tanium addressed the vulnerability, with a CVSS v3.1 base score of 6.3 (Network attack vector, Low privileges required, No user interaction; confidentiality, integrity, and availability...
CVE-2026-17191 VeloCloud Orchestrator Flow Metrics API SQL Injection
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended...
