PT-2025-12073

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version v0.6.0 Description The issue allows execution of arbitrary SQL queries without access control through the web API endpoint POST /api/v1/editor/sql/run. This can be exploited to perform Arbitrary File Write using...

PT-2025-12074

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version v0.6.0 Description The issue allows execution of arbitrary SQL queries without access control through the web API endpoint POST /api/v1/editor/chart/run. This can be exploited to perform Arbitrary File Write, enabli...

MENNEKES Ladesäule Smart SQL Injection Vulnerability

MENNEKES Ladesäule Smart is a smart charging post from MENNEKES. A SQL injection vulnerability exists in MENNEKES Ladesäule Smart versions prior to 2.15, which stems from an insufficient value neutralization and could lead to the execution of arbitrary SQL commands...

CVE-2024-42844

A SQL Injection vulnerability has been identified in EPICOR Prophet 21 P21 up to 23.2.5232. This vulnerability allows authenticated remote attackers to execute arbitrary SQL commands through unsanitized user input fields to obtain unauthorized information...

TYPO 3.16.0 SQL Injection

TYPO version 3.16.0 suffers from a remote SQL injection vulnerability. ============================================================================================================================================= | Title : TYPO 3.16.0 Code Injection Vulnerability | | Author : indoushka | | Tested...

CVE-2024-50706

An unauthenticated SQL injection vulnerability exists in Uniguest Tripleplay (versions prior to 24.2.1 , including 23.1+ ). This flaw allows remote attackers to execute arbitrary SQL queries on the backend database. To remediate this issue, users should update to version 24.2.1 or later. Exploita...

PT-2025-9675

Name of the Vulnerable Software and Affected Versions Uniguest Tripleplay versions prior to 24.2.1 Description The issue is an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries on the backend database. Recommendations For versions prior to...

CVE-2025-22210

A SQL injection vulnerability exists in the Hikashop component for Joomla versions 3.3.0 through 5.1.4 . The flaw allows authenticated attackers with administrator privileges to execute arbitrary SQL commands within the category management area in the backend. Practical consequences include unaut...

CVE-2025-27133: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the adicionartipoexame.php endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive...

CVE-2025-26606

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, informacaoadicional.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthoriz...

CVE-2025-27096: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a Web Manager for Institutions with a focus on Portuguese language. A SQL Injection vulnerability was discovered in the WeGIA application, personalizacaoupload.php endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive...

CVE-2025-26605

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, deletarcargo.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access...

CVE-2025-26605

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, "deletarcargo.php" endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing acce...

CVE-2025-26609 SQL Injection endpoint 'familiar_docfamiliar.php' parameter 'id_dependente', 'id_doc' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, familiardocfamiliar.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthoriz...

CVE-2025-26612 SQL Injection endpoint 'adicionar_almoxarife.php' parameter 'id_almoxarifado', 'id_funcionario' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, adicionaralmoxarife.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthoriz...

CVE-2025-26614

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, "deletardocumento.php" endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access...

CVE-2025-26610: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, restaurarprodutodesocultar.php endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowin...

CVE-2025-26614: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, deletardocumento.php endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access t...

CVE-2025-26605: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, deletarcargo.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access...

CVE-2025-1389

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...