The vulnerability of the website collaborative management platform WIMP, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary commands.

The vulnerability of the WIMP website-sharing platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Bdtask Wholesale Inventory Control SQL注入漏洞

Bdtask Wholesale Inventory Control is an inventory management system from Bdtask Bangladesh. A SQL injection vulnerability exists in Bdtask Wholesale Inventory Control 20251013 and earlier versions, which stems from incorrect manipulation of the parameter firstname/lastname in the file...

PT-2025-43875

Name of the Vulnerable Software and Affected Versions projectworlds Online Shopping System version 1.0 Description A flaw has been identified in projectworlds Online Shopping System 1.0. The issue involves a potential SQL injection affecting an unknown function within the /login submit.php file...

Code-Projects Nero Social Networking Site SQL注入漏洞

Nero Social Networking Site is a social networking site. Nero Social Networking Site suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter ID of the file /addfriend.php. An attacker can exploit this vulnerability to...

Exploit for CVE-2023-49440

CVE-2023-49440-POC Vulnerable Version: Ahab EPP Management v...

SQL Injection

Overview langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to SQL Injection via improper handling of filter $eq, $ne, $gt, $lt, $gte, $lte operators in the LangGraph SQLite store implementation. An...

LangGraph's SQLite store implementation has a SQL Injection Vulnerability

A SQL injection vulnerability exists in the langchain-ai/langgraph repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators $eq, $ne, $gt, $lt, $gte, $lt...

CVE-2025-9322 Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection

The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameter in all versions up to, and including, 8.3.1 due to insufficient escaping on the user supplied parameter and lack ...

CVE-2025-11893 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donationids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of...

Studio Fabryka DobryCMS SQL注入漏洞

Studio Fabryka DobryCMS is a content management system from Studio Fabryka, Inc. Studio Fabryka DobryCMS suffers from a SQL injection vulnerability that stems from improper neutralization of user-entered language functions, which could lead to an SQL injection attack...

CVE-2025-62617

Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role such as an administrator can explo...

Privilege Escalation

intelliants/subrion is vulnerable to privilege escalation. The vulnerability is due to improper access control in the built-in “Run SQL Query” feature under the SQL Tool admin panel, which allows authenticated administrators or moderators to execute arbitrary SQL commands and gain escalated...

ChanCMS /cms/article/findField File SQL Injection Vulnerability

ChanCMS is a content management system. A SQL injection vulnerability exists in ChanCMS 3.3.2 and earlier versions, which originates from the lack of validation of external SQL statements in the function findField in the file /cms/article/findField. An attacker can exploit this vulnerability to...

CVE-2025-62617

Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role such as an administrator can explo...

MGASA-2025-0243 Updated python-django packages fix a security vulnerability

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the kwarg...

EUVD-2025-35541

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through = 3.8.5...

EUVD-2025-35568

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Alexander AnyComment anycomment allows SQL Injection.This issue affects AnyComment: from n/a through = 0.3.6...

CVE-2025-62015

CVE-2025-62015 is a SQL Injection in WordPress plugin Advanced Coupons for WooCommerce Coupons (free version), affecting versions up to and including 4.6.8 due to improper neutralization of SQL, with multiple sources confirming and a patch released (updated to 4.6.8+). Mitigation: update to the p...

CVE-2025-59557

CVE-2025-59557 concerns a SQL injection in the WordPress plugin Learts Addons (versions prior to 1.7.5). The root cause is improper neutralization of special elements used in SQL commands in the learts-addons component, enabling potential SQL injection attacks. Affected product: WordPress plugin ...

CVE-2025-49931 WordPress JetSearch plugin <= 3.5.10 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through = 3.5.10...