SQL Injection Vulnerability in UFIDA U8Cloud of UFIDA Network Technology Co.

UFIDA U8Cloud is an enterprise-level ERP used to assist companies in achieving efficient and digitalized business collaboration and process management. A SQL injection vulnerability exists in UFIDA U8Cloud, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2025-46801

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or...

CVE-2025-46801

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or...

PHPGurukul Daily Expense Tracker System 安全漏洞

Daily Expense Tracker System is a PHP and MySQL based daily expense tracking system. The Daily Expense Tracker System suffers from a SQL injection vulnerability that stems from a lack of validation of externally-entered SQL statements in the email parameter of the file /forgot-password.php. An...

PT-2025-21695 · Wpgym · Wpgym

Name of the Vulnerable Software and Affected Versions: WPGYM versions prior to 65.0 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection, which allows Blind SQL Injection. This is due to the improper handling of...

OpenText Advance Authentication SQL注入漏洞

OpenText Advance Authentication is an enterprise-grade multi-factor authentication MFA and identity management platform from OpenText Canada that supports a zero-trust architecture. An SQL injection vulnerability exists in OpenText Advance Authentication versions prior to 6.5, which stems from...

BIT-PGPOOL-2025-22248

The PgPool II component into a Bitnami Pgpool II container image comes by default configured with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. This can be addressed by mounting and overwriting the Pgpool configuration file directly. If PgPool is exposed...

PT-2025-20841 · Bitnami +2 · Bitnami/Postgres-Ha +3

Name of the Vulnerable Software and Affected Versions: bitnami/pgpool affected versions not specified bitnami/postgres-ha affected versions not specified Description: The bitnami/pgpool Docker image and the bitnami/postgres-ha k8s chart, under default configurations, come with a repmgr user that...

PT-2025-20844 · Siemens · Polarion

Name of the Vulnerable Software and Affected Versions: Polarion V2310 All versions Polarion V2404 versions prior to V2404.4 Description: The application insufficiently validates user input for database read queries, which could allow an authenticated remote attacker to conduct an SQL injection...

PT-2025-20879 · Unknown · Domainspro

Name of the Vulnerable Software and Affected Versions: DomainsPRO version 1.2 Description: The issue is an SQL injection vulnerability that could allow an attacker to retrieve, create, update, and delete databases. This is achieved via the d parameter in the "/article.php" endpoint...

CVE-2025-1993

IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, 12.8, 12.9, and 12.10 DesignerAuthoring instances store their flows in a database that is protected by weaker than expected...

CVE-2025-1993 IBM App Connect Enterprise Certified Container information disclosure

IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, 12.8, 12.9, and 12.10 DesignerAuthoring instances store their flows in a database that is protected by weaker than expected...

PT-2025-20584 · Ibm · Ibm App Connect Enterprise Certified Container

Name of the Vulnerable Software and Affected Versions: IBM App Connect Enterprise Certified Container versions 8.1 through 12.10 Description: The issue concerns the use of weaker than expected cryptographic algorithms to protect the database storing flows in DesignerAuthoring instances. This coul...

Beijing NetDynamic Network Technology Co., Ltd. NetDynamic unified communication platform suffers from sql injection vulnerability

NetDrive Unified Communications Platform is a comprehensive communications platform designed to enhance users' communication efficiency and convenience and provide a unified communications environment. A sql injection vulnerability exists in the NetDrive Unified Communications Platform of Beijing...

CVE-2025-3708

Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-4204 Ultimate Auction Pro <= 1.5.2 - Unauthenticated SQL Injection via 'auction_id'

The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auctionid’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2024-13322

CVE-2024-13322 describes an unauthenticated SQL injection in the WordPress Ads Pro Plugin (Multi-Purpose Advertising Manager) up to version 4.88. The root cause is insufficient escaping of the a_id parameter and lack of proper preparation in the existing SQL query, allowing attackers to append ad...

PT-2025-18746 · Sunnet · Ehdr Ctms

Name of the Vulnerable Software and Affected Versions: eHDR CTMS from Sunnet affected versions not specified Description: The issue allows remote attackers with regular privileges to inject arbitrary SQL commands to read database contents. This is a SQL Injection vulnerability. Recommendations: A...

PT-2025-18751 · WordPress · Advance Seat Reservation Management

Name of the Vulnerable Software and Affected Versions: Advance Seat Reservation Management for WooCommerce plugin for WordPress versions up to, and including, 3.3 Description: The issue allows for SQL Injection via the profileId parameter due to insufficient escaping on the user-supplied paramete...

ZTE GoldenDB DDE Injection Vulnerability

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. ZTE GoldenDB suffers from a DDE injection vulnerability, which can be...