CVE-2019-25536

Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability in the features[] parameter. Unauthenticated attackers can send crafted POST requests to index.php to execute arbitrary SQL, enabling extraction of sensitive data or manipulation of queries. The issue is described as a...

PT-2026-24994

Netartmedia PHP Car Dealer contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features parameter. Attackers can submit POST requests to index.php with crafted SQL payloads in the features parameter...

Netartmedia PHP Car Dealer SQL注入漏洞

Netartmedia PHP Car Dealer is a website system for car dealers operated by the Bulgarian company Netartmedia. Netartmedia PHP Car Dealer has a SQL injection vulnerability; this vulnerability stems from the SQL injection present in the features parameter, which may allow unverified attackers to...

Graphiti 安全漏洞

Graphiti is a framework developed by Zep for building temporal context graphs for AI agents. Versions of Graphiti prior to 0.28.2 contained security vulnerabilities. These vulnerabilities stemmed from Cypher injections in the shared search filter construction that occurs outside of the Kuzu...

EUVD-2018-21621

Meneame English Pligg 5.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to index.php with crafted SQL payloads in the search parameter to...

CVE-2018-25189

Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dcalogin.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive database information including...

CVE-2018-25182

CVE-2018-25182 affects Silurus Classifieds Script 2.0. The vulnerability is an SQL injection in wcategory.php via the ID parameter, allowing unauthenticated remote attackers to craft SQL payloads to extract database names and sensitive information. CVSS metrics indicate high severity (CVSS 3.1: 8...

Data Center Audit SQL注入漏洞

Data Center Audit is a data auditing software developed by Ben Patridge. Version 2.6.2 of Data Center Audit contains a SQL injection vulnerability. This vulnerability stems from an SQL injection issue with the username parameter in the dcalogin.php file, which may allow unverified attackers to...

Silurus Classifieds Script SQL注入漏洞

Silurus Classifieds Script is an information classification script program developed by the British company Silurus. Version 2.0 of Silurus Classifieds Script contains a SQL injection vulnerability. This vulnerability stems from an SQL injection issue with the ID parameter, which may allow...

Gumbo CMS SQL注入漏洞

Gumbo CMS is a content management system developed by Gumbo CMS Inc. Version 0.99 of Gumbo CMS has a SQL injection vulnerability. This vulnerability stems from the language parameter in the settings endpoint, which allows for SQL injections. It may lead to the execution of arbitrary SQL queries a...

EUVD-2019-19729

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue...

CVE-2019-25503

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue...

CVE-2019-25503

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue...

CVE-2026-1487

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers...

SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access

Summary /api/query/sql allows users to run SQL directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any SQL query on the database. Details The vulnerable endpoint is in kernel/api/sql.go go func SQLc gin.Context ret := gulu.Ret.NewResult defer...

GHSA-JQWG-75QF-VMF9 SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access

Summary /api/query/sql allows users to run SQL directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any SQL query on the database. Details The vulnerable endpoint is in kernel/api/sql.go go func SQLc gin.Context ret := gulu.Ret.NewResult defer...

CVE-2026-28399

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3...

CVE-2026-24908

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the sort parameter...

CVE-2026-23627

OpenEMR before v8.0.0 exposes an SQL Injection in the Immunization module. The vulnerability arises because user-supplied patient_id values are concatenated into SQL WHERE clauses without parameterization or escaping, allowing an authenticated user to execute arbitrary SQL. This can lead to compl...

PT-2026-21970

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0 Description OpenEMR is an electronic health records and medical practice management application. A flaw exists in the Immunization module where user-supplied patient id values are directly incorporated into SQL...