CVE-2025-15436 Yonyou KSOA work_edit.jsp sql injection

A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/workedit.jsp. Such manipulation of the argument Report leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may b...

CVE-2025-15436

CVE-2025-15436 affects Yonyou KSOA 9.0. The issue lies in the file /worksheet/work_edit.jsp where manipulating the Report argument enables SQL injection. It can be exploited remotely, with the exploit publicly disclosed and vendor contact attempts noted as unaddressed. Multiple sources (NVD, Red ...

CVE-2025-15434

Summary: CVE-2025-15434 affects Yonyou KSOA 9.0 via an SQL injection in an unknown function of the file /kp/PrintZPYG.jsp, caused by manipulating the zpjhid parameter. Reports indicate remote exploitation with the exploit publicly available. Multiple sources (NVD, Red Hat, CVE list, CNNVD, ENISA,...

CVE-2025-15420

A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agentworkreport.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The...

QNAP Systems Hyper Data Protector SQL注入漏洞

QNAP Systems Hyper Data Protector is a one-stop backup software from Taiwan, China-based QNAP Systems. QNAP Systems Hyper Data Protector suffers from a SQL injection vulnerability that stems from susceptibility to SQL injection attacks that could result in the execution of unauthorized code or...

PT-2026-1115

Name of the Vulnerable Software and Affected Versions code-projects Online Music Site version 1.0 Description A flaw exists in code-projects Online Music Site 1.0 that allows for SQL injection. The issue is located in the /Frontend/AlbumByCategory.php file, specifically through manipulation of th...

Yonyou KSOA SQL注入漏洞

Yonyou KSOA is an enterprise-level management software from China's UFIDA Yonyou Corporation. A SQL injection vulnerability exists in Yonyou KSOA version 9.0, which originates from an incorrect manipulation of the parameter Report in the file /worksheet/workupdate.jsp, which could lead to a SQL...

Code-Projects Online Music Site SQL注入漏洞

Code-Projects Online Music Site is an open source online music site by Code-Projects. A SQL injection vulnerability exists in Code-Projects Online Music Site version 1.0, which stems from incorrect manipulation of the parameter ID in the file /Frontend/ViewSongs.php, which could lead to a SQL...

daptin SQL注入漏洞

daptin is a content management system from Daptin open source. A SQL injection vulnerability exists in daptin version 0.10.3, which stems from incorrect manipulation of the parameters column/group/order within the file server/resource/resourceaggregate.go in the component Aggregate API, which can...

CVE-2025-55065

CVE-2025-55065 is a SQL injection flaw (CWE-89) caused by improper neutralization of special elements in SQL commands. Connected sources reference Kopek Reem ReKord Client and general SQLi impact; no concrete affected versions or patches are specified in the provided documents. Exploitation detai...

EUVD-2026-0011

A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Createproduct.php. Performing manipulation of the argument dretitle results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public...

WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability

Software : Gecko Type : Theme Vulnerable versions : = 1.9.8 OWASP Top 10 : A3: Injection Classification : Local File Inclusion CVE ID : CVE-2025-69080 Patchstack priority : High CVSS severity : 8.1 Required privilege : Unauthenticated Developer : Claim ownership PSID : 0d458b5a65e6 Credits : Tran...

Code-Projects Online Guitar Store SQL注入漏洞

Code-Projects Online Guitar Store is a Code-Projects open source online guitar store. A SQL injection vulnerability exists in Code-Projects Online Guitar Store version 1.0, which stems from an incorrect operation of the parameter delpro in the file /admin/Deleteproduct.php, which could lead to SQ...

PT-2026-1019

Name of the Vulnerable Software and Affected Versions code-projects Online Guitar Store version 1.0 Description A flaw exists in code-projects Online Guitar Store 1.0 that allows for SQL injection. This occurs through manipulation of the del pro argument within the /admin/Delete product.php file...

CVE-2025-62139 WordPress Terms descriptions plugin <= 3.4.9 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Vladimir Statsenko Terms descriptions allows Retrieve Embedded Sensitive Data.This issue affects Terms descriptions: from n/a through 3.4.9...

CVE-2025-15388

The CVE-2025-15388 entry relates to the VPN Firewall product from QNO Technology, which is reported to be vulnerable to an OS Command Injection. The connected documents consistently describe an authenticated remote attacker scenario capable of injecting and executing arbitrary OS commands on the ...

WordPress AHAthat Plugin plugin <= 1.6 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Régis SENET in WordPress Plugin AHAthat versions = 1.6...

WordPress Featured Image from URL (FIFU) plugin <= 5.2.7 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by ifoundbug in WordPress Plugin Featured Image from URL versions = 5.2.7...

PT-2025-54456

Name of the Vulnerable Software and Affected Versions PKrystian Full-Stack-Bank versions prior to bf73a0179e3ff07c0d7dc35297cea0be0e5b1317 Description A flaw exists in the User Handler component of PKrystian Full-Stack-Bank. Manipulation of unknown code within this component can lead to SQL...

WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.4.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions = 1.4.9...