CVE-2025-3011

SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-3011

PiExtract SOOP-CLM is affected by a SQL Injection vulnerability (CVE-2025-3011). Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. Affected product: SOOP-CLM from PiExtract; CVSSv3.1 score: 9.8 (CRITICAL) with Network access, no priv...

CVE-2025-3011 PiExtract SOOP-CLM - SQL Injection

SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-30367 WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information...

PT-2025-13051 · Wppool · Wppool Flexstock

Name of the Vulnerable Software and Affected Versions: WPPOOL FlexStock versions 3.13.1 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, due to the improper neutralization of special elements used in an SQL command. This allows f...

CVE-2025-2585

EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-2585 EBM Technologies EBM Maintenance Center - SQL injection

EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-2200

SQL injection vulnerability in the IcProgreso Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query on the parameters user, id, idGroup, startdate and enddate in the endpoint...

CVE-2025-2199

SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query in ‘searchActionsToUpdate’, ‘searchSpecialitiesPending’,...

CVE-2025-2200

SQL injection vulnerability in the IcProgreso Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query on the parameters user, id, idGroup, startdate and enddate in the endpoint...

CVE-2025-2200

The CVE-2025-2200 entry concerns a SQL injection vulnerability in the IcProgreso Innovación y Cualificación plugin (endpoint /report/icprogreso/generar_blocks.php). The issue allows an attacker to read, update, and delete database data by injecting SQL through the parameters user, id, idGroup, st...

CVE-2025-2199 SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php

SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query in ‘searchActionsToUpdate’, ‘searchSpecialitiesPending’,...

SQL Injection

pimcore/pimcore is vulnerable to SQL injection. The vulnerability is due to improper input sanitization and lack of parameterized queries, allowing an attacker to manipulate database queries, extract sensitive data, modify records, or escalate privileges...

CVE-2025-1751

A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones. This vulnerability allows an attacker to retrieve, create, update and delete database via $idServicio parameter in /modules/ajaxBloqueaCita.php endpoint...

CVE-2025-1751 SQL Injection CIGES

A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones. This vulnerability allows an attacker to retrieve, create, update and delete database via $idServicio parameter in /modules/ajaxBloqueaCita.php endpoint...

CVE-2025-1023 SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

CVE-2025-25222

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

CVE-2025-25221

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

CVE-2025-1389

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-1389

CVE-2025-1389 pertains to Orca HCM by Learning Digital, where a SQL injection vulnerability exists in the application. The connected sources confirm that an attacker with regular privileges can inject arbitrary SQL commands to read, modify, and delete database contents. The issue is described con...