Zoho ManageEngine OpManager - SQL Injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

vBulletin <= 4.2.3 - SQL Injection

vBulletin versions 3.6.0 through 4.2.3 are vulnerable to an SQL injection vulnerability in the vBulletin core forumrunner addon. The vulnerability allows an attacker to execute arbitrary SQL queries and potentially access sensitive information from the database. id: CVE-2016-6195 info: name:...

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

Ghost CMS Content API - SQL Injection

Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload. id: CVE-2026-26980 info: name: Ghost CMS Content API - SQL Injection author:...

XWiki Platform - SQL Injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

Jms Blog - SQL Injection

The module Jms Blog jmsblog from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes id: CVE-2023-27034 info: name: Jms Blog - SQL Injection author: MaStErChO severity: critical...

CVE-2026-122038

A flaw was found in EmployeeRecruitmentSystem. A remote, unauthenticated attacker can submit specially crafted input to the Requirement Board Update Handler source/reqformprocessing.php, leading to a Structured Query Language SQL injection vulnerability. This flaw allows an attacker to execute...

CVE-2026-111492

A flaw was found in MatchPoint. The application's push notification handler constructs database queries by concatenating untrusted input received from push notification messages, resulting in a SQL Structured Query Language injection vulnerability. An attacker capable of sending crafted messages ...

CVE-2026-100365

A flaw was found in SuiteCRM. An authenticated remote user with report generation access can supply crafted field labels that are concatenated directly into database queries without proper validation. This vulnerability enables SQL injection SQLi, allowing an attacker to achieve unauthorized...

CVE-2024-24137

CVE-2024-24137: Student File Managment System SQL Injection Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24137.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24137/blob/main/CVE-2024-24137.md...

CVE-2023-1454

CVE-2023-1454 CVE-2023-1454 Vulnerability Detection Script This article is for reference only. Do not use the technical materials and tools in this article to intrude into any computer system without authorization. The direct or indirect consequences and losses caused by the information provided ...

CVE-2026-81815

A flaw was found in Apache OFBiz. A remote, unauthenticated attacker can exploit a Structured Query Language SQL injection vulnerability by submitting a specially crafted search request. This issue occurs because the entity engine improperly sanitizes input values when building database queries o...

CVE-2025-71456

A flaw was found in vtenext. A Structured Query Language SQL injection vulnerability exists in the Fax module due to improper validation of the fieldname parameter. An authenticated remote attacker with low privileges can exploit this flaw by sending a specially crafted request to execute arbitra...

CVE-2024-7854

CVE-2024-7854 Woo Inquiry = 0.1 - Unauthenticated SQL Injection Description: The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the...

EUVD-2026-117816

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive...

CVE-2025-71458 FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo

FTS3 Web Monitoring fts-monitoring versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by getlinkinfo. Remote attackers can inject SQL through the sourcese and destse query parameters to perform blind injection and rea...

CVE-2025-71458

FTS3 Web Monitoring (fts-monitoring ) versions 3.12.0 through 3.13.2 and 3.14.0 are vulnerable to an unauthenticated SQL injection in the /linkinfo endpoint. The flaw resides in the get_linkinfo function, where an attacker can inject SQL via the source_se and dest_se query parameters. This allows...

EUVD-2025-211270

FTS3 Web Monitoring fts-monitoring versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by getlinkinfo. Remote attackers can inject SQL through the sourcese and destse query parameters to perform blind injection and rea...

CVE-2024-32640-SQLI-MuraCMS

And exploited SQL injection vulnerabilities in Mura/Masa CMS. Save this script as CVE-2024-32640.sh and make it executable: chmod +x CVE-2024-32640.sh Run it using: ./CVE-2024-32640-SQLI-MuraCMS.sh --url https://example.com/ --ghauri '--dump --threads 10' @Helltakerc3rb...

CVE-2026-63774

The Subnet Solutions PowerSYSTEM Center is vulnerable to an SQL Injection (CWE-89) due to insufficient input validation in the report designer . This flaw allows an authenticated user to execute unauthorized SQL commands. The vulnerability carries a CRITICAL severity rating (CVSS 4.0 score of 9.4...