CVE-2022-38743

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. ...

CVE-2020-1937

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries...

CVE-2019-8134

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with marketing privileges can execute arbitrary SQL queries in the database when accessing email template variables...

CVE-2019-10671

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2019-0393

An SQL Injection vulnerability in SAP Quality Management corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03 allows an attacker to carry out targeted database queries that can read individual fields of historical inspection results...

CVE-2018-1000650

LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Injection vulnerability in Show Groups Popup SQL query functions that can result in Ability to perform malicious database queries. This attack appear to be exploitable via User controlled parameters...

PT-2025-22046 · Unknown · Absolute Links

Name of the Vulnerable Software and Affected Versions: Absolute Links versions n/a through 1.1.1 Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection, which can ...

The vulnerability of the Authenticate method in software for managing and monitoring remote objects in telemetry and telemechanics systems, allowing a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Authenticate method in software for managing and monitoring remote objects in telemetry and telemechanics systems related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the...

PT-2025-17193 · Quentn Wp · Quentn Wp

Name of the Vulnerable Software and Affected Versions: Quentn WP versions 1.2.8 and earlier Description: The issue is related to an SQL Injection flaw, which is caused by the improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations...

Azure Linux 3.0 Security Update: vitess (CVE-2024-53257)

The version of vitess installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53257 advisory. - Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env...

SAP NetWeaver 缓冲区错误漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. SAP NetWeaver suffers from a buffer overflow vulnerability that stems from improper handling of memory addresses, which could allow an attacker to execute certain forms of SQL queries. An attack...

Joomla! SQL注入漏洞

Joomla! is a free, open source content management system from Joomla! open source. A SQL injection vulnerability exists in Joomla! that stems from improper handling of identifiers, resulting in a SQL injection vulnerability...

PT-2025-37375

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30 Description Chamilo is a learning management system. A flaw exists due to a failure to neutralize special elements used in an OS command. Successful exploitation could allow a remote attacker to execute...

The vulnerability of the sqlgplace_dpipes component in the Virtuoso-OpenSource web application development platform allows a hacker to trigger a service failure.

The vulnerability of the sqlgplacedpipes component in the Virtuoso-opensource web application development platform involves the distribution of resources without any restrictions or regulations. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially...

PT-2025-13715 · WordPress · Aphotrax Uptime Robot Plugin

Name of the Vulnerable Software and Affected Versions: Aphotrax Uptime Robot Plugin for WordPress versions n/a through 2.3 Description: The issue is related to an SQL Injection vulnerability, allowing attackers to manipulate database queries. This is due to the improper neutralization of special...

The vulnerability of the VMmanager 6 virtualization tool, related to the lack of protective measures for the SQL query structure, allows attackers to execute arbitrary SQL queries against the database.

The vulnerability of VMmanager 6’s virtualization mechanism is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database remotely...

CVE-2025-0723 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Vanna 跨站请求伪造漏洞

Vanna is a personalized AI SQL agent from Vanna. Vanna suffers from a cross-site request forgery vulnerability. An attacker exploiting this vulnerability could run arbitrary SQL commands...

WordPress plugin WordPress Awesome Import & Export Plugin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

SQL Injection

moodle/moodle is vulnerable to SQL injection. The vulnerability is due to insufficient input sanitization in the module list filter, allowing attackers to manipulate database queries...