CVE-2025-53091 WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated...

CVE-2025-53091

WeGIA is vulnerable to an unauthenticated Time-Based Blind SQL Injection in the almox parameter of the /controle/getProdutosPorAlmox.php endpoint (WeGIA version 3.3.3). The issue, caused by lack of input validation, allows an attacker to inject arbitrary SQL queries and potentially access or exfi...

WordPress Hover Effects plugin <= 2.1.2 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Jamaal ahmed in WordPress Plugin Hover Effects versions = 2.1.2...

CVE-2025-53256

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in YayCommerce YaySMTP yaysmtp allows SQL Injection.This issue affects YaySMTP: from n/a through = 2.6.6...

CVE-2025-6768

The CVE-2025-6768 affects sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, specifically the HospitalServiceImpl.java::findAllHosByCondition function. The root cause is manipulation of the hospitalName argument leading to SQL injection, enabling remote exploitation. Multiple con...

CVE-2025-53314 WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through = 2.5.0...

CVE-2025-53306 WordPress WP Forum Server plugin <= 1.8.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in lucidcrew WP Forum Server allows SQL Injection. This issue affects WP Forum Server: from n/a through 1.8.2...

CVE-2025-53306 WordPress WP Forum Server plugin <= 1.8.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in lucidcrew WP Forum Server forum-server allows SQL Injection.This issue affects WP Forum Server: from n/a through = 1.8.2...

CVE-2025-53306

CVE-2025-53306 affects the lucidcrew WP Forum Server plugin (versions

CVE-2025-53258 WordPress Hover Effects plugin <= 2.1.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wow-Company Hover Effects hover-effects allows SQL Injection.This issue affects Hover Effects: from n/a through 2.1.2...

CVE-2025-6766 sfturing hosp_order OfficeServiceImpl.java getOfficeName sql injection

A vulnerability was found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been declared as critical. This vulnerability affects the function getOfficeName of the file OfficeServiceImpl.java. The manipulation of the argument officesName leads to sql injection. The atta...

CVE-2025-52829

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DirectIQ DirectIQ Email Marketing directiq-wp allows SQL Injection.This issue affects DirectIQ Email Marketing: from n/a through = 2.0...

CVE-2025-52834

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through = 2.4.7...

CVE-2025-52722

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JoinWebs Classiera classiera allows SQL Injection.This issue affects Classiera: from n/a through = 4.0.34...

CVE-2025-23967

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpopal GG Bought Together for WooCommerce gg-bought-together allows SQL Injection.This issue affects GG Bought Together for WooCommerce: from n/a through = 1.0.2...

CVE-2025-39474 WordPress Amely theme <= 3.1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ThemeMove Amely amely allows SQL Injection.This issue affects Amely: from n/a through = 3.1.4...

CVE-2025-52717 WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through = 8.0.6...

CVE-2025-52717

CVE-2025-52717 corresponds to an SQL Injection in the WordPress plugin LifterLMS (versions n/a through 8.0.6). Multiple sources confirm a server-side SQL injection vulnerability due to improper neutralization of SQL commands in LifterLMS, affecting the WP LMS for eLearning, Online Courses, and Qu...

CVE-2025-52717 WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through = 8.0.6...

CVE-2025-52722 WordPress Classiera theme <= 4.0.34 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JoinWebs Classiera classiera allows SQL Injection.This issue affects Classiera: from n/a through = 4.0.34...