Projectworlds Visitor Management System 注入漏洞

Visitor Management System is a visitor access management system. Visitor Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter rid in the file /visitorout.php. An attacker can exploit this...

Joomla! SQL注入漏洞

Joomla! is a free, open source content management system from Joomla! open source. A SQL injection vulnerability exists in Joomla! versions 3.9.2-3.10.1, which originates from a privileged user being able to execute arbitrary SQL commands, potentially resulting in a SQL injection attack...

CVE-2025-8989

The connected documents provide concrete details for CVE-2025-8989: a SQL injection vulnerability in SourceCodester COVID 19 Testing Management System 1.0, caused by improper handling of the mobilenumber parameter in /edit-phlebotomist.php. The issue is exploitable remotely and may affect other p...

CVE-2025-8985 SourceCodester COVID 19 Testing Management System profile.php sql injection

A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been...

CVE-2025-55168

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/saude/aplicarmedicamento.php endpoint, specifically in the idfichamedica parameter. This vulnerability allows...

Malicious code in @zalastax/nolb-graphql-g (npm)

The package @zalastax/nolb-graphql-g was found to contain malicious code...

MAL-2025-9142 Malicious code in @omisepayments/in-app-communication-graphql-sdk (npm)

The package @omisepayments/in-app-communication-graphql-sdk was found to contain malicious code...

CVE-2025-47954

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2025-53727

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2025-52797

CVE-2025-52797 corresponds to a CSRF vulnerability in the WordPress StoryMap Plugin <= 2.1 that may enable SQL injection. Public documents confirm affected software (StoryMap Plugin), and version

CVE-2025-55708 WordPress Quiz And Survey Master Plugin <= 10.2.4 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ExpressTech Systems Quiz And Survey Master allows SQL Injection. This issue affects Quiz And Survey Master: from n/a through 10.2.4...

CVE-2025-8972 itsourcecode Online Tour and Travel Management System page-login.php sql injection

A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-8972

CVE-2025-8972 affects itsourcecode Online Tour and Travel Management System 1.0. A SQL injection exists in /admin/page-login.php due to improper handling of the email parameter, enabling remote exploitation without authentication. Public disclosure of the exploit is noted. Impact is described acr...

CVE-2025-8971 itsourcecode Online Tour and Travel Management System travellers.php sql injection

A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument val-username leads to sql injection. The attack can be initiated remotely. The exploi...

CVE-2025-8970 itsourcecode Online Tour and Travel Management System booking.php sql injection

A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/booking.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclose...

CVE-2025-8970

CVE-2025-8970 affects itsourcecode Online Tour and Travel Management System 1.0. The vulnerability is in the file /admin/operations/booking.php, where manipulation of the ID parameter enables an SQL injection. The issue is exploitable remotely, with public disclosure of the exploit noted in multi...

CVE-2025-8969 itsourcecode Online Tour and Travel Management System approve_user.php sql injection

A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/approveuser.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has be...

CVE-2025-8966

A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/tax.php. The manipulation of the argument tname leads to sql injection. The attack may be initiated remotely. The exploit has been...

Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions

A bypass of the DISALLOWEDSQLFUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leadi...

CVE-2025-55674

A bypass of the DISALLOWEDSQLFUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leadi...