WS-2022-0424

thorsten/phpmyfaq before 3.1.9 is vulnerable to SQL Injection inside instance name that leads to Remote Code Execution. An attacker has a severe impact by being allowed to recover all or part of your database including sensitive data like usernames and passwords hash, Modify or insert data in the...

WS-2022-0425

thorsten/phpmyfaq prior to 3.1.9 is vulnerable to SQL Injection inside category creation checkIfCategoryExists. A user with the permission to add a category can dump the whole database. It can use the data retrieved to get an administrator account. An attacker could also use mathematical function...

CVE-2026-4776

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands...

CVE-2026-41075

A flaw was found in RT, an open-source issue and ticket tracking system. An authenticated user can exploit an SQL injection vulnerability by crafting malicious input. This input is then incorporated into database queries without proper validation, potentially allowing the attacker to read or modi...

CVE-2018-25398: Improper Neutralization of Special Elements used in an SQL Command

The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the frmpasswd parameter. Attackers can send POST requests to main.php with crafted SQL payloads to extract sensitive...

PT-2026-44872

Name of the Vulnerable Software and Affected Versions Kados R10 GreenBee affected versions not specified Description An SQL injection flaw allows unauthenticated attackers to execute arbitrary SQL queries. This occurs because the release id parameter in the 'boards buttons/update release.php'...

CVE-2026-10039: Improper Neutralization of Special Elements used in an SQL Command

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

Mermaid security vulnerabilities

Mermaid is an open-source application developed by mermaid-js. It uses text and code to create charts and visualizations. Versions of Mermaid prior to 10.9.6 and 11.15.0 have security vulnerabilities. These vulnerabilities arise from the use of the excludes property when rendering Gantt charts; i...

EUVD-2026-33350

Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level privileges can exploit this through the OrderDirective component. This allows for the extraction of sensitive information...

PT-2026-44860

Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the uname parameter. Attackers can send crafted requests to profile.php with UNION-based SQL injection payloads to retrieve table names, column...

CVE-2018-25385: Improper Neutralization of Special Elements used in an SQL Command

E-Registrasi Pencak Silat 18.10 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the idpartai parameter. Attackers can send GET requests to monitornilai.php with crafted SQL payloads in the idpartai...

PT-2026-44882

Name of the Vulnerable Software and Affected Versions Open ISES Project version 3.30A Description An SQL injection flaw allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code via the ticket id parameter when sending GET requests to the 'add...

PT-2026-44877

Name of the Vulnerable Software and Affected Versions Open ISES Project version 3.30A Description An SQL injection issue allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code into the tick lat and tick lng parameters via GET requests sent ...

PT-2026-44870

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the log activity function. Attackers can send POST requests to /index.php/user/log activity with malicious SQL code ...

PT-2026-44864

HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries by injecting SQL code through the 'id' parameter. An unauthenticated attacker can exploit the desa module module=desa&act=hapus, while authenticated users can exploi...

PT-2026-44843

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.50 FreePBX versions prior to 17.0.11 Description The CDR Reports module page allows SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This issue occurs throug...

PT-2026-44867

HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama kelompok' POST parameter sent to lap-anggota-kelompok-pdf.php. Attackers can send a crafted request with a time-based blind payload to...

Sitejo HaPe PKH SQL Injection Vulnerability

Sitejo HaPe PKH is a community poverty alleviation project management system developed by Sitejo Corporation. Version 1.1 of Sitejo HaPe PKH contains an SQL injection vulnerability. This vulnerability arises from injecting SQL code through the desa POST parameter, allowing unauthenticated attacke...

Bylancer Zechat SQL Injection Vulnerability

Bylancer Zechat is a PHP instant messaging system developed by Bylancer Corporation, which supports real-time messages, group chat, and social interactions. Version 1.5 of Bylancer Zechat has a SQL injection vulnerability. This vulnerability arises from injecting SQL code via the uname parameter,...

PT-2026-44873

Name of the Vulnerable Software and Affected Versions Kados R10 GreenBee affected versions not specified Description An SQL injection issue exists that allows unauthenticated attackers to execute arbitrary SQL queries. This occurs because the feature id parameter in the 'boards buttons/update...