The vulnerability of the NetworksController.addNetworkAction() function in software for remote monitoring with virtual private network capabilities, such as Advantech WebAccess/VPN, allows a intruder to gain access to database-related information.

The vulnerability of the NetworksController.addNetworkAction function in software for remote monitoring with virtual private networks like Advantech WebAccess/VPN is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Shenzhou Vision Han Technology Co., Ltd (CNVD-C-2025-925280)

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2025-12482: Improper Neutralization of Special Elements used in an SQL Command

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

The vulnerability of the AjaxDeviceController.ajaxActionValidateTable() function in the software for remote monitoring with Advantech WebAccess/VPN virtual private network capabilities allows a perpetrator to gain access to database-related information.

The vulnerability of the AjaxDeviceController.ajaxActionValidateTable function in the software for remote monitoring with Advantech WebAccess/VPN virtual private network capabilities is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability may all...

The vulnerability of the AjaxDeviceController.ajaxDeviceAction() function in the software for remote monitoring with virtual private network capabilities, Advantech WebAccess/VPN, allows a perpetrator to gain access to database-related information.

The vulnerability of the AjaxDeviceController.ajaxDeviceAction function in the software for remote monitoring with Advantech WebAccess/VPN virtual private network capabilities is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability could allow a...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Shenzhou Vision Han Technology Co., Ltd (CNVD-C-2025-824752)

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2025-34245

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34241

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34242: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34240: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34247: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34246: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34243: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34245: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-34244: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

CVE-2025-10748: Improper Neutralization of Special Elements used in an SQL Command

The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-42755

Name of the Vulnerable Software and Affected Versions Epsilon RH affected versions not specified Description A SQL Injection issue exists in Epsilon RH by Grupo Castilla. This allows an attacker to retrieve, create, update, and delete database information. Exploitation occurs by sending a POST...

PT-2025-42309

Name of the Vulnerable Software and Affected Versions WP Google Map Plugin versions prior to 1.0 Description The WP Google Map Plugin for WordPress is susceptible to a blind SQL Injection issue. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL...

PT-2025-42300

Name of the Vulnerable Software and Affected Versions WP jQuery Pager plugin versions through 1.4.0 Description The WP jQuery Pager plugin for WordPress is susceptible to SQL Injection through the 'ids' shortcode attribute parameter. This is due to inadequate escaping of user-supplied input and...

ERPNext inventory_dimensions_dict parameter SQL injection vulnerability

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a SQL injection vulnerability that originates from the presence of SQL injection in the inventorydimensionsdict parameter, which can be exploited by an attacker to obtain database information...