CVE-2025-52327

SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file...

CVE-2025-52327

The Restaurant Order System version 1.0 is vulnerable to an SQL Injection vulnerability within the payment.php file. A local attacker can exploit this flaw to obtain sensitive information . No patch or newer version with a fix is currently available in the provided documentation. Exploitation det...

CVE-2025-50868

A SQL Injection vulnerability exists in CloudClassroom-PHP-Project version 1.0 . The issue is located in the takeassessment2.php file, where the Q4 POST parameter is not properly sanitized before being used in SQL queries. This flaw could allow an attacker to execute unauthorized database command...

CVE-2025-50868

A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before being used in SQL queries...

PT-2025-31643 · Unknown · Restaurant Order System

Name of the Vulnerable Software and Affected Versions: Restaurant Order System version 1.0 Description: A SQL Injection issue exists in Restaurant Order System 1.0. A local attacker can obtain sensitive information via the payment.php file. Recommendations: At the moment, there is no information...

PT-2025-31682

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 4.1.1 Patch 15 Description An authenticated SQL injection flaw allows a low-privileged attacker to extract administrator credentials and escalate privileges. Following privilege escalation, an unrestricted file upload...

PT-2025-31637

Name of the Vulnerable Software and Affected Versions Gandia Integra Total versions 2.1.2217.3 through 4.4.2236.1 Description A SQL injection vulnerability exists in Gandia Integra Total. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete databases through...

PT-2025-31658 · Unknown · Cloudclassroom-Php Project

Name of the Vulnerable Software and Affected Versions: CloudClassroom-PHP-Project version 1.0 Description: A SQL Injection issue exists in the takeassessment2.php file. The Q4 POST parameter is not properly sanitized before being used in SQL queries. Recommendations: Ensure proper sanitization of...

PT-2025-31636

Name of the Vulnerable Software and Affected Versions Gandia Integra Total TESI versions 2.1.2217.3 through 4.4.2236.1 Description A SQL injection vulnerability exists in Gandia Integra Total TESI. The vulnerability allows an authenticated attacker to retrieve, create, update, and delete database...

CVE-2014-125123

An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel developed by LXCenter prior to version 6.1.12. The flaw resides in the login-name parameter passed to lbin/webcommand.php, which fails to properly sanitize input, allowing an attacker to extract the...

CVE-2013-10033

An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the dbrestore.php endpoint. The flaw allows attackers to inject arbitrary SQL queries into the dates POST parameter, enabling file write via INTO OUTFILE under specific environmental conditions. This can lead to...

CVE-2025-8408 code-projects Vehicle Management filter1.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /filter1.php. The manipulation of the argument vehicle leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2013-10033 Kimai 0.9.2 db_restore.php SQL Injection

An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the dbrestore.php endpoint. The flaw allows attackers to inject arbitrary SQL queries into the dates POST parameter, enabling file write via INTO OUTFILE under specific environmental conditions. This can lead to...

CVE-2013-10033

Kimai 0.9.2.x is affected by an unauthenticated SQL injection via db_restore.php (dates[]), allowing arbitrary SQL and file write via INTO OUTFILE under certain environmental conditions. This can enable remote code execution by writing a PHP payload to the web-accessible temp directory. Affected ...

CVE-2025-40682

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint...

CVE-2025-8382 Campcodes Online Hotel Reservation System edit_room.php sql injection

A vulnerability, which was classified as critical, was found in Campcodes Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/editroom.php. The manipulation of the argument roomid leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2025-8378 Campcodes Online Hotel Reservation System Login index.php sql injection

A vulnerability was found in Campcodes Online Hotel Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attac...

CVE-2025-8378

CVE-2025-8378 affects Campcodes Online Hotel Reservation System 1.0. The vulnerability is a SQL injection in the Login component, exploitable via manipulation of the username/password arguments in /admin/index.php. Impact is described as critical with network-based, low-complexity access and no p...

CVE-2025-8376

CVE-2025-8376 affects code-projects Vehicle Management 1.0, with a SQL injection in the updatebal.php file caused by unsafely handling the company parameter. Public exploitation is indicated by multiple sources; remote attacker access is possible and data confidentiality/integrity/availability ca...

CVE-2025-8376 code-projects Vehicle Management updatebal.php sql injection

A vulnerability classified as critical has been found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /updatebal.php. The manipulation of the argument company leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed ...