6895 matches found
CVE-2025-69180
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through = 6.7...
CVE-2025-68999
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Blind SQL Injection.This issue affects Happy Addons for Elementor: from n/a through = 3.20.4...
CVE-2025-68034
CVE-2025-68034 affects the CleverReach® WP WordPress plugin up to version 1.5.22. The root cause is Improper Neutralization of Special Elements in SQL Commands, enabling SQL Injection. Impact is high confidentiality risk (CVE notes HIGH) with potential data exposure/modification; exploitation is ...
CVE-2025-49050
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through = 2.5...
CVE-2025-36588
Dell Unisphere for PowerMax, versions 10.2.0.x, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...
CVE-2025-4764
The CVE-2025-4764 issue is a SQL Injection vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot, due to improper neutralization of special elements in SQL commands. Affected product/version: Hotel Guest Hotspot up to and including 22012026. Impact is rated high (CVSS 3.1...
CVE-2025-27378
AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute arbitrary SQL queries...
CVE-2025-27378
AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute arbitrary SQL queries...
PT-2026-4259
Name of the Vulnerable Software and Affected Versions shinetheme Traveler versions prior to 3.2.8 Description An issue exists in shinetheme Traveler that allows for Blind SQL Injection due to Improper Neutralization of Special Elements used in an SQL Command. This allows an attacker to potentiall...
PT-2026-3923
Name of the Vulnerable Software and Affected Versions Aida Computer Information Technology Inc. Hotel Guest Hotspot versions through 22012026 Description A flaw exists in Aida Computer Information Technology Inc. Hotel Guest Hotspot that allows for SQL Injection due to improper neutralization of...
CVE-2025-67261
Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page...
WordPress Koko Analytics plugin <= 2.1.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Hector Ruiz Ruiz in WordPress Plugin Koko Analytics versions = 2.1.2...
Abacre Retail Point of Sale security vulnerability
Abacre Retail Point of Sale is a new generation retail management software developed by the Canadian company Abacre. Version 14.0.0.396 of Abacre Retail Point of Sale contains a security vulnerability, which stems from a content-based blind SQL injection vulnerability in the order search function...
CVE-2026-1178 Yonyou KSOA HTTP GET Parameter select.jsp sql injection
A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid leads to sql injection. The attack can be initiated remotely. The...
CVE-2026-22850 Koko Analytics vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import
Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import. Unauthenticated visitors can submit arbitrary path pa and referrer r values to the public...
CVE-2026-1160 PHPGurukul Directory Management System Search index.php sql injection
A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the component Search. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been...
EUVD-2026-3211
A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the component Search. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been...
EUVD-2026-3221
SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12...
CVE-2026-1132
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/editfolder.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument folderid results in sql injection. The attack can be initiated remotely. The exploit has...