CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

CVE-2025-67650

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...

CVE-2025-67649

CVE-2025-67649 affects PHP Jabbers – Car Rental Script. A SQL injection vulnerability arises from improper neutralization of user input in parameters used for sorting, enabling unauthenticated attackers to perform SQL Injection. The issue is fixed in version 4.1. If applying mitigations, upgrade ...

vulnerabilities in Adobe Campaign Classic

Adobe has identified vulnerabilities in Adobe Campaign Classic ACC. The first vulnerability relates to incorrect authorization in ACC’s core authorization mechanisms, allowing attackers to execute arbitrary code without any user interaction. This means that attackers can perform actions beyond th...

CVE-2026-15381

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-51432

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-15381

The WP Go Maps WordPress plugin prior to version 10.1.04 is vulnerable to an unauthenticated SQL injection via the Markers REST filter due to improper sanitisation/escaping of a parameter before it is used in a SQL query. Impact is low according to the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L...

EUVD-2026-51428

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

PT-2026-66748

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...

EUVD-2025-210576

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters districtid , divisionid, regionid, and wardid...

PT-2026-66860

Name of the Vulnerable Software and Affected Versions Modern Loan Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, at the '/admin/delete group.php' endpoint via the id...

CVE-2025-69933

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1...

CVE-2025-69934

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...

CVE-2025-69931

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembership.php?id=1...

CVE-2026-62845 Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...

CVE-2026-62845

Kamaji (Hosted Control Plane Manager for Kubernetes) is affected by a SQL injection in the PostgreSQL and MySQL datastore drivers. The root cause is that DataStoreUsername and DataStoreSchema are interpolated into SQL statements via fmt.Sprintf without escaping identifiers, and these fields have ...

CVE-2026-54368 CentreStack < 17.4 SQL Injection via x-glad-filter Header

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

EUVD-2026-51013

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...