16798 matches found
CVE-2025-49485
CVE-2025-49485: A SQL injection in Balbooa Forms for Joomla affects versions 1.0.0 through 2.3.1.1. The vulnerability is triggered via the id parameter, enabling privileged users to execute arbitrary SQL commands (per CVSS 4.0 metrics: NETWORK, HIGH impact on confidentiality/integrity/availabilit...
CVE-2025-26854
A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands...
CVE-2025-26855 Extension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for Joomla
A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands...
CVE-2025-26854
The CVE-2025-26854 entry describes a SQL injection in the Joomla extension Articles Good Search (versions 1.0.0–1.2.4.0011). In affected releases, attackers can execute arbitrary SQL commands. Mitigation: upgrade to a version later than 1.2.4.0011 (per PT-2025-30010) or apply vendor-provided fixe...
CVE-2025-6717
The B1.lt plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.2.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
CVE-2025-6717 B1.lt for WooCommerce <= 2.2.56 - Authenticated (Subscriber+) SQL Injection
The B1.lt plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.2.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
CVE-2025-6718 B1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection
The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1runquery AJAX action in all versions up to, and including, 2.2.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL...
CVE-2025-6718 B1.lt for WooCommerce <= 2.2.56 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection
The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1runquery AJAX action in all versions up to, and including, 2.2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL...
CVE-2025-7638 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 1.45.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
PT-2025-30082 · Beijing Shenzhou Shihan Technology · Multimedia Integrated Business Display System
Name of the Vulnerable Software and Affected Versions: Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System versions up to 8.2 Description: A critical vulnerability exists in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System. The...
CVE-2025-50585
StudentManage v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/adminStudentUrl...
PT-2025-30083 · Unknown · Student-Manage
Name of the Vulnerable Software and Affected Versions: StudentManage version 1.0 Description: StudentManage version 1.0 contains a SQL injection vulnerability via the /admin/adminStudentUrl component. Recommendations: At the moment, there is no information about a newer version that contains a fi...
XWiki 1.0 < 15.10.16, 16.0.0-rc-1 < 16.4.7, 16.5.0-rc-1 < 16.10.2 SQLi Vulnerability (GHSA-prwh-7838-xf82)
Xwiki is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescriptio...
CVE-2025-50585
CVE-2025-50585 affects StudentManage v1.0. A SQL injection in the /admin/adminStudentUrl component arises from improper input handling, enabling potentially unauthorized data access and manipulation. The vulnerability is rated with CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base score 8.8, HI...
Cisco Evolved Programmable Network Manager SQLi (cisco-sa-piepnm-bsi-25JJqsbb)
The version of Cisco Evolved Programmable Network Manager installed on the remote host is affected by a vulnerability. A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, low-privileged, remote...
Fortinet FortiWeb SQL Injection Vulnerability
Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests...
CVE-2025-7765
CVE-2025-7765 affects code-projects Online Appointment Booking System 1.0, specifically the /admin/addmanagerclinic.php file. The vulnerability arises from manipulation of the clinic parameter, enabling SQL injection. It is exploitable remotely and exploitation has been publicly disclosed. Multip...
CVE-2025-7764
CVE-2025-7764 affects code-projects Online Appointment Booking System v1.0. The vulnerability is an SQL injection in the /admin/deletedoctorclinic.php file, caused by unsafely handling the clinic parameter in an unknown function. Exploitation can be performed remotely and has been disclosed publi...
CVE-2025-7757
CVE-2025-7757 affects PHPGurukul Land Record System 1.0. The vulnerability exists in an unknown functionality of /edit-property.php where the editid parameter can be manipulated to cause SQL injection. The issue can be exploited remotely and the exploit has been disclosed publicly. Multiple conne...