CVE-2019-5720

includes/db/class.reflinesdb.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the voidtransaction.php filterType parameter...

CVE-2014-9577

VDG Security SENSE formerly DIVA 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response...

CVE-2018-11369

An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the database via the \apps\home\controller\ParserController.php scode parameter...

CVE-2006-5248

Eazy Cart stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a customer database via a direct request for admin/config/customer.dat. NOTE: the provenance of this information is unknown; the details are obtained from third...

CVE-2025-40621 Multiple vulnerabilities in TCMAN's GIM

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’...

CVE-2025-3280

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attributevaluefilter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

GHSA-G9JJ-75MX-WJCX org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

Impact It is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend. Depending on the used database backend, the attacker may be able to not only obtain confidential information...

CVE-2025-3470

CVE-2025-3470 describes an authenticated SQL Injection in the WordPress plugin TS Poll – Survey, Versus Poll, Image Poll, Video Poll, affecting versions up to and including 2.4.6. The root cause is insufficient escaping of the user-supplied s parameter and inadequate preparation in the existing S...

CVE-2025-1264

The connected Red Hat entry confirms CVE-2025-1264 for the Broken Link Checker by AIOSEO (WordPress). It describes an SQL Injection via the orderBy parameter in all versions ≤ 1.2.3 due to insufficient escaping and lack of proper query preparation. Exploitation requires authenticated access at Co...

DataEase 2.4.0 - Database Configuration Information Exposure

Exploit Title: DataEase 2.4.0 - Database Configuration Information Exposure Shodan Dork: http.html:"dataease" FOFA Dork: body="dataease" && title=="DataEase" Exploit Author: ByteHunter Email: [email protected] vulnerable Versions: 2.4.0-2.5.0 Tested on: 2.4.0 CVE : CVE-2024-30269 import...

CVE-2019-25222

CVE-2019-25222 affects the WordPress plugin Thumbnail carousel slider (versions

CVE-2024-52905

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged user...

CVE-2024-13844

The CVE-2024-13844 entry concerns Post SMTP for WordPress. It describes an SQL Injection via the columns parameter in versions up to 3.1.2, exploitable by an authenticated Administrator+ user to append additional SQL and extract sensitive data. Wordfence notes this CVE as patched in the related v...

CVE-2024-13781

The Hero Maps Premium plugin for WordPress is vulnerable to SQL Injection via several AJAX actions in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PHPGurukul Nipah virus Testing Management System 注入漏洞

Nipah Virus Testing Management System is an online virus diagnostic platform. The Nipah Virus Testing Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the checkavailability.php file. An attacker can exploit...

CVE-2025-27408

CVE-2025-27408 affects Manifest. The vulnerability arises from using SHA3 without a salt prior to version 4.9.2, causing deterministic password hashes and increased risk of cracking if the database is compromised. A fix is available in version 4.9.2. Connected documents corroborate the issue and ...

Clinical Research Firm Exposes 1.6 Million US Medical Survey Records

A Dallas, Texas-based clinical research firm had its database exposed, containing sensitive personal healthcare records of over 1.6…...

CVE-2024-13485

The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-13491

CVE-2024-13491 affects the WordPress plugin Small Package Quotes – For Customers of FedEx . The vulnerability is an SQL Injection in parameters edit_id and dropship_edit_id due to insufficient escaping and inadequate preparation of the SQL query. It affects versions up to and including 4.3.1 and ...

EUVD-2025-4699

The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...