PT-2025-7382 · WordPress · Pollin

Name of the Vulnerable Software and Affected Versions: Pollin plugin for WordPress versions up to, and including, 1.01.1 Description: The issue allows unauthenticated attackers to perform SQL Injection via the question parameter due to insufficient escaping on the user-supplied parameter and lack...

ChurchCRM 安全漏洞

ChurchCRM is an open source CRM system built for churches by ChurchCRM Open Source. A security vulnerability exists in ChurchCRM 5.13.0 and earlier versions, which stems from the EID parameter being directly connected to a SQL query without proper cleanup, which is susceptible to SQL injection...

WordPress LTL Freight Quotes – SAIA Edition plugin <= 2.2.10 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Colin Xu in WordPress Plugin LTL Freight Quotes – SAIA Edition versions = 2.2.10...

WordPress plugin Distance Rate Shipping for WooCommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

LuxSoft LuxCal Web Calendar SQL注入漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. A SQL injection vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.3.3M and prior to 5.3.3L, which originates from a SQL injection in retrieve.php and could lead...

WeGIA 访问控制错误漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. WeGIA has an access control error vulnerability that originates from the documentoexcluir.php page of the WeGIA application instance containing a SQL injection vulnerability...

PT-2025-27650 · Ооо 'Айди Технологии Управления' · Documino

Уязвимость платформы автоматизации процессов электронного документооборота Documino связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии путём отправки специально сформированного SQL-запроса...

WordPress plugin Simple Signup Form SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A SQL injection...

CVE-2025-1389

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...

Chat System add_chatroom.php File SQL Injection Vulnerability

Chat System is a chat system. Chat System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the chatname/chatpass parameters of the /user/addchatroom.php file. An attacker can exploit this vulnerability to execute illega...

LuxSoft LuxCal Web Calendar SQL注入漏洞

LuxSoft LuxCal Web Calendar is a free user-friendly lightweight web-based event calendar from LuxSoft Switzerland. A SQL injection vulnerability exists in LuxSoft LuxCal Web Calendar versions prior to 5.3.3M and prior to 5.3.3L, which stems from information in the database that could be deleted,...

Wazifa System control.php File SQL Injection Vulnerability

Wazifa System is a content management system. Wazifa System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the /controllers /control.php file. An attacker can exploit this vulnerability to execute illegal SQL commands t...

PT-2025-7062 · Unknown · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M MySQL version LuxCal Web Calendar versions prior to 5.3.3L SQLite version Description: The issue concerns an SQL injection vulnerability in the retrieve.php file. If exploited, this vulnerability m...

PT-2025-6909 · Codezips · Codezips Gym Management System

Name of the Vulnerable Software and Affected Versions: Codezips Gym Management System version 1.0 Description: A critical issue affects some unknown functionality of the file /dashboard/admin/del plan.php. The manipulation of the argument name leads to SQL injection. The attack may be launched...

WordPress plugin LTL Freight Quotes – FreightQuote Edition SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin LTL Freigh...

CVE-2025-22209

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature...

CVE-2025-26348

A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'" in maxprofile/menu/model.lua editUserMenu endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP reques...

CVE-2025-1200

A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/app/slidercrud.php. The manipulation of the argument delid leads to sql injection. The attack can be initiated remotely. Th...

WordPress LTL Freight Quotes – FreightQuote Edition Plugin <= 2.3.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Colin Xu Patchstack Alliance in WordPress Plugin LTL Freight Quotes – FreightQuote Edition versions = 2.3.11...

WordPress plugin LTL Freight Quotes SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...