CVE-2024-13507: Improper Neutralization of Special Elements used in an SQL Command

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-7638: Improper Neutralization of Special Elements used in an SQL Command

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 1.45.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress plugin Forminator Forms – SQL injection vulnerability in Contact Form, Payment Form, and Custom Form Builder

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A SQL injection vulnerability exists in WordPress...

Exploit for SQL Injection in Dimdavid File_Provider

CVE-2025-4578 File Provider = 5.0.12 time-based blind - Parame...

📄 WordPress Events Manager 7.0.3 SQL Injection

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-6970: Improper Neutralization of Special Elements used in an SQL Command

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-53527 WeGIA allows Time-Based Blind SQL Injection in the relatorio_geracao.php endpoint

WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatoriogeracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or...

CVE-2025-53527: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatoriogeracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or...

CVE-2025-5339

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsaproid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

U.S. Dept Of Defense: SQL Injection in URI Path Leading to Full Database Disclosure on ████████

A time-based blind SQL injection vulnerability was discovered in the URI path of the /home/server-ocsp/ endpoint on a U.S. Government Public Key Infrastructure website. The vulnerability allowed an unauthenticated attacker to interact with the backend MySQL database and extract sensitive...

CVE-2025-5590

The Owl carousel responsive plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-53091

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the "/controle/getProdutosPorAlmox.php" endpoint. This issue allows any unauthenticated...

CVE-2025-53091: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated...

CVE-2025-51672

A time-based blind SQL injection vulnerability was identified in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability exists in the manage-companies.php file and allows remote attackers to execute arbitrary SQL code via the companyname parameter in a POST request...

CVE-2025-5590: Improper Neutralization of Special Elements used in an SQL Command

The Owl carousel responsive plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

📄 PiHome MaxAir Smart Thermostat SQL Injection

A security vulnerability has been identified in the PiHome MaxAir Smart Thermostat system that permits an authenticated attacker to execute arbitrary SQL statements against the backend database. Description: A security vulnerability has been identified in the PiHome MaxAir Smart Thermostat system...

CVE-2025-51672

A time-based blind SQL injection vulnerability exists in the PHPGurukul Dairy Farm Shop Management System 1.3 . The flaw is located in the manage-companies.php file and stems from a lack of validation of externally entered SQL statements. Remote attackers can execute arbitrary SQL code by providi...

Quest KACE Systems Management Appliance security vulnerabilities

Quest Software Quest KACE Systems Management Appliance is an IT asset management appliance from Quest Software, USA. A security vulnerability exists in the Quest KACE Systems Management Appliance that stems from a logical flaw in the implementation of two-factor authentication, which could lead t...

Today'S Cat Is Tomorrow'S Dog: Accounting for Time-Based Changes in the Labels of ML Vulnerability Detection Approaches

Vulnerability datasets used for ML testing implicitly contain retrospective information. When tested on the field, one can only use the labels available at the time of training and testing e.g. seen and assumed negatives. As vulnerabilities are discovered across calendar time, labels change and...

📄 Beakon SQL Injection

Beakon versions prior to 5.4.3 suffer from a remote unauthenticated time-based SQL injection vulnerability. Title: Unauthenticated Time Based SQL Injection Vulnerability in Beakon versions prior to 5.4.3 Description: An unauthenticated time-based SQL injection vulnerability exists in the Beakon...