CVE-2025-49421

Summary (CVE-2025-49421) An SQL Injection vulnerability exists in the WordPress plugin “WP Text Expander” (Andrei Filonov) affecting version range from an unknown starting point up to and including 1.0.1. The root cause is improper neutralization of SQL commands, enabling attackers with authentic...

CVE-2023-26003 WordPress WP Post Corrector <= 1.0.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in vipul Jariwala WP Post Corrector allows SQL Injection. This issue affects WP Post Corrector: from n/a through 1.0.2...

CVE-2025-26590

CVE-2025-26590 relates to the Complete Google Seo Scan WordPress plugin. Connected sources confirm a SQL Injection vulnerability affecting “Complete Google Seo Scan” versions up to 3.5.1. The Wordfence entry explicitly classifies this as an Authenticated (Administrator+) SQL Injection and notes t...

CVE-2025-49328 WordPress Store Locator WordPress plugin <= 1.5.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows SQL Injection.This issue affects Store Locator WordPress: from n/a through = 1.5.1...

CVE-2025-49328 WordPress Store Locator WordPress <= 1.5.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Agile Logix Store Locator WordPress allows SQL Injection. This issue affects Store Locator WordPress: from n/a through 1.5.1...

CVE-2025-49328

CVE-2025-49328 affects Store Locator WordPress (Agile Logix Store Locator Plugin). Description confirms an SQL Injection vulnerability due to improper input handling in Store Locator WordPress versions up to 1.5.1. Red Hat and Wordfence entries corroborate: exploitation requires authenticated acc...

CVE-2025-49327

CVE-2025-49327 is a SQL Injection in ShortLinks Pro (WordPress plugin) affecting ShortLinks Pro versions up to 1.0.7. The Red Hat entry confirms the issue description as an SQL injection vulnerability in ShortLinks Pro. Wordfence intelligence also lists CVE-2025-49327 with “ShortLinks Pro

CVE-2025-49327 WordPress ShortLinks Pro plugin <= 1.0.7 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ruben Garcia ShortLinks Pro shortlinkspro allows SQL Injection.This issue affects ShortLinks Pro: from n/a through = 1.0.7...

CVE-2025-49326 WordPress GamiPress <= 7.4.5 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ruben Garcia GamiPress allows SQL Injection. This issue affects GamiPress: from n/a through 7.4.5...

CVE-2025-49323 WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through = 1.1.10...

CVE-2025-49315

CVE-2025-49315 affects Persian Woocommerce SMS (Persian Script plugin) and is an SQL Injection due to improper neutralization of inputs in SQL commands. Affected versions range up to 7.0.10; exploitation would involve untrusted input influencing a SQL query. The Wordfence vulnerability listing in...

CVE-2025-49315 WordPress Persian Woocommerce SMS plugin <= 7.0.10 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows SQL Injection.This issue affects Persian Woocommerce SMS: from n/a through = 7.0.10...

CVE-2025-5759 PHPGurukul Local Services Search Engine Management System edit-person-detail.php sql injection

A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. This vulnerability affects unknown code of the file /admin/edit-person-detail.php?editid=2. The manipulation of the argument editid leads to sql injection. The attack can be initiate...

CVE-2025-5758 SourceCodester Open Source Clinic Management System doctor.php sql injection

A vulnerability classified as critical has been found in SourceCodester Open Source Clinic Management System 1.0. This affects an unknown part of the file /doctor.php. The manipulation of the argument doctorname leads to sql injection. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-5755 SourceCodester Open Source Clinic Management System email_config.php sql injection

A vulnerability was found in SourceCodester Open Source Clinic Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /emailconfig.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The...

SQL Injection

llamaindex is vulnerable to SQL Injection. The vulnerability is due to SQL injection due to improper handling of user input in multiple vector store integrations, allowing attackers to manipulate SQL queries and access or modify unauthorized data...

CVE-2025-5729 code-projects Health Center Patient Record Management System birthing_record.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Health Center Patient Record Management System 1.0. Affected is an unknown function of the file /birthingrecord.php. The manipulation of the argument itrno leads to sql injection. It is possible to launch the attack...

CVE-2025-5563 WP-Addpub <= 1.2.8 - Authenticated (Contributor+) SQL Injection

The WP-Addpub plugin for WordPress is vulnerable to SQL Injection via the 'wp-addpub' shortcode in all versions up to, and including, 1.2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-2921

The CVE-2023-2921 entry concerns the WordPress Short URL plugin (versions ≤ 1.6.8). A parameter is not properly sanitised/escaped before its use in an SQL statement, enabling SQL injection. Impact is stated as exploitable by users with low privileges (e.g., subscribers). Affected component is the...

CVE-2025-5711 code-projects Real Estate Property Management System InsertCity.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /Admin/InsertCity.php. The manipulation of the argument cmbState leads to sql injection. It is possible to launch the attack...