265401 matches found
Esri ArcGIS Server SQL injection vulnerability
Esri ArcGIS Server versions 12.1 and earlier contain an SQL injection vulnerability. This vulnerability stems from SQL injection and may allow authorized remote attackers to access the service and invoke specific database functions that should not be permitted. Anonymously, attackers may also...
VulnCheck KEV: CVE-2025-11452
The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$COOKIE'asgarosforumunreadexclude'' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
PT-2026-123426
Name of the Vulnerable Software and Affected Versions @aws-cdk/aws-redshift-alpha versions prior to 2.274.0-alpha.0 Description SQL injection exists in the database-query custom resource handlers. A third party capable of influencing construct property values can execute SQL statements with Amazo...
Crocoblock JetEngine SQL injection vulnerability
Crocoblock JetEngine versions 3.9.0 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...
Dolibarr SQL injection vulnerability
Versions 19.0.0 through 23.0.4 of Dolibarr contain an SQL injection vulnerability. This flaw arises because the type field in the third-party bankaccounts REST endpoint is not properly escaped. Authenticated API users with the societe/creer privilege can inject SQL code into...
Amazon AWS Cloud Development Kit SQL injection vulnerability
Amazon AWS Cloud Development Kit versions prior to 2.274.0-alpha.0 contain an SQL injection vulnerability. This vulnerability stems from improper handling of database-query custom resources, potentially allowing unauthorized parties to execute SQL statements using specially crafted usernames,...
itsourcecode Online Cake Ordering System input validation error vulnerability
The 1.0 version of itsourcecode’s Online Cake Ordering System contains a security vulnerability stemming from improper handling of the ID parameter in the /deletetransac.php file, which may lead to SQL injection...
PT-2026-123311
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...
UBUNTU-CVE-2026-46531
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm default General Administration role can...
EUVD-2026-109964
SQL Injection vulnerability in CRM SOFTTRADE Infotech aka softtradeindia 1.0 allows a remote attacker to execute arbitrary code via the Login Page...
WordPress Media Library Assistant SQL injection vulnerability
WordPress Media Library Assistant versions 3.42 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to blind SQL injection...
PT-2026-123264
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42...
PT-2026-123353
Name of the Vulnerable Software and Affected Versions CRM SOFTTRADE Infotech version 1.0 Description A SQL Injection issue exists in the login page. A remote attacker can inject SQL commands through the login form to execute arbitrary code on the affected system. SQL Injection is a technique wher...
PT-2026-125533
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes...
PT-2026-125523
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count...
PT-2026-125073
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service which could, depending on the service being configured in a non-default access configuration “public”, include an...
PT-2026-123158
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the atta...
PT-2026-123128
A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /deletetransac.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could ...
itsourcecode Online Book Store input validation error vulnerability
The 1.0 version of itsourcecode Online Book Store contains a security vulnerability stemming from improper handling of the bookisbn parameter in the /book.php file, which may lead to SQL injection...
