84005 matches found
WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection
WordPress Secure Copy Content Protection and Content Locking plugin before 2.8.2 contains a SQL injection vulnerability. The plugin does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action, available to both unauthenticated and authenticated users, before using it in a SQL...
CVE-2026-58046
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...
CVE-2026-13395
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
EUVD-2026-51013
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-67247
A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...
CVE-2026-67247
CVE-2026-67247 describes a path traversal vulnerability in ADM’s IHM Log handling where user-controlled disk serial input is not sufficiently validated before being used to construct the path to an IHM log database file. An authenticated attacker could access an unintended filesystem path or log ...
CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM
A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...
EUVD-2025-210529
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1...
EUVD-2025-210538
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in checkavailability.php via the parameters emailid and email...
CVE-2025-69930
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...
EUVD-2025-210556
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...
CVE-2025-69941
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...
CVE-2025-69935
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenuereport.php via the fromDate parameter...
CVE-2025-69933
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1...
CVE-2026-51293
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51291
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-66586
Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0 Description SQL Injection occurs in the 'edit type.php' endpoint through the id parameter. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for...
PT-2026-66575
Name of the Vulnerable Software and Affected Versions Spikster versions prior to commit e1cdf8c Description A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the CipiAuth middleware is registered but not applied to any route within...