CVE-2025-58462: Improper Neutralization of Special Elements used in an SQL Command

OPEXUS FOIAXpress Public Access Link PAL before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database...

CVE-2023-48260

The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...

CVE-2025-29512

Cross-Site Scripting XSS vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the database...

CVE-2025-3011: Improper Neutralization of Special Elements used in an SQL Command

SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-30352

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the search query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the...

CVE-2025-1389: Improper Neutralization of Special Elements used in an SQL Command

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-0455: Improper Neutralization of Special Elements used in an SQL Command

The airPASS from NetVision Information has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

NetVision Information airPASS SQL注入漏洞

NetVision Information airPASS is an application from China-based NetVision Information. NetVision Information airPASS suffers from a SQL injection vulnerability that originates from a susceptibility to SQL injection attacks, which allows an unauthenticated, remote attacker to inject arbitrary SQL...

CVE-2024-9980

The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify and delete database contents...

CVE-2024-9982

CVE-2024-9982 affects Esi Technology’s AIM LINE Marketing Platform. The vulnerability arises from improper validation of a specific query parameter, enabling an unauthenticated attacker to inject arbitrary FetchXml commands when the LINE Campaign Module is enabled, with read/modify/delete access ...

CVE-2024-9921: Improper Neutralization of Special Elements used in an SQL Command

The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify and delete database contents...

TEAMPLUS Team+ SQL注入漏洞

TEAMPLUS Team+ is an enterprise private cloud communication and collaboration platform from China Interactive Ares TEAMPLUS. A SQL injection vulnerability exists in TEAMPLUS Team+ v13.5.x. The vulnerability stems from incorrect validation of specific page parameters, which allows an...

CVE-2024-8327: Improper Neutralization of Special Elements used in an SQL Command

Easy test Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2024-7732: Improper Neutralization of Special Elements used in an SQL Command

Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents...

PT-2024-15950 · Tenable · Nessus

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content. Recommendations: At the moment, there is no information...

CVE-2023-48260

The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...

Cross site request forgery (csrf)

The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...

CVE-2023-48261

The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...

CVE-2023-48259

The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...

CVE-2023-29047: Improper Neutralization of Special Elements used in an SQL Command

Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent network and potentially API credentials, could read and modify database content which is accessible...