CVE-2026-78056

sambitraj Student-Management-System (up to commit 56ba287) contains a SQL injection vulnerability in the Dashboard component. Manipulation of the roll_no or teacher_name argument allows a remote, authenticated attacker to inject SQL queries. The exploit is public and classified as proof-of-concep...

PT-2026-79765

A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This manipulation of the argument delid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be use...

PT-2026-79785

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC de CVE-2026-52715 Proof of Concept educativa de GeoLeak CVE-2026-52715, injeção SQL não autenticada CVSS 9.3 no plugin GEO my WordPress = 4.5.5 para WordPress. Os parâmetros swlatlng e nelatlng dos limites do mapa são interpolados sem saneamento na cláusula WHERE. Laboratório Docker...

CVE-2024-46532

Numero CVE: CVE-2024-46532 fornitore: 上海顶想信息科技有限公司https://www.kancloud.cn/ prodotto: 互联网医疗系统医疗门诊OpenHIS versione: V1.0 componente interessata: https://github.com/1638824607/OpenHIS?tab=readme-ov-file Riproduzione delle vulnerabilità di SQL Injection in OpenHIS Vulnerabilità：...

CVE-2020-28413_Mantis2.24.3-SQLi-SOAP

Dieses Repository hat keine README-Datei...

CVE-2024-12270

CVE-2024-12270 Beautiful Taxonomy Filters = 2.4.3 - SQL Injection non autenticata Descrizione Il plugin Beautiful Taxonomy Filters per WordPress è vulnerabile a SQL Injection tramite il parametro 'selects0term' in tutte le versioni fino alla 2.4.3 inclusa, a causa di un insufficiente escaping del...

CVE-2026-76602

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76571

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2025-57819-FreePBX-RCE2Root

CVE-2025-57819 — SQLi su FreePBX → RCE → Root PoC a catena completa per CVE-2025-57819. Iniezione SQL basata su errori non autenticata nel modulo endpoint di FreePBX che si trasforma in una shell root tramite iniezione di cron job ed escalation di privilegi incron. Solo per test autorizzati e...

CVE-2024-13481

CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition = 3.3.4 - SQL Injection non autenticata Descrizione Il plugin LTL Freight Quotes – R+L Carriers Edition per WordPress è vulnerabile a SQL Injection tramite i parametri 'editid' e 'dropshipeditid' in tutte le versioni fino alla 3.3.4 inclusa...

CVE-2026-76602 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76602 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

EUVD-2026-64329

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors...

CVE-2026-76602

Fabrik is a Joomla extension (fabrikar.com) that provides form and database management. In versions below 4.7.3 , the order parameter in list models is passed directly into database queries without validation, enabling unauthenticated SQL injection via the ORDER BY clause. This allows an attacker...

CVE-2026-76571 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2026-76571

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.3 are vulnerable to an unauthenticated SQL injection in the list filter condition parameter. The root cause is that the condition parameter is concatenated verbatim into the WHERE clause constructed by getFilterQuery(), allowing an...

EUVD-2026-64327

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.3 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2026-76571 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2022-0739

CVE-2022-0739 BookingPress 1.0.11 - Nicht authentifizierte SQL-Injection Das Plugin versäumt es, die vom Benutzer bereitgestellten POST-Daten ordnungsgemäß zu bereinigen, bevor sie in einer dynamisch erstellten SQL-Abfrage verwendet werden, und zwar über die AJAX-Aktion...