CVE-2025-6169 HAMASTAR Technology WIMP website co-construction management platform - SQL Injection

The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-6169 HAMASTAR Technology WIMP website co-construction management platform - SQL Injection

The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2025-6100 realguoshuai open-video-cms list sql injection

A vulnerability was found in realguoshuai open-video-cms 1.0. It has been rated as critical. This issue affects some unknown processing of the file /v1/video/list. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to...

PT-2025-25583 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical issue has been identified, affecting the /insertNominee.php file. The client id and nominee id arguments are vulnerable to SQL injection. This issue can be...

Siemens TeleControl Server Basic UpdateDatabaseSettings SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens TeleControl Server Basic. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

PT-2025-25579 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /insertagent.php. The manipulation of the agent id argument leads to SQL...

Siemens TeleControl Server Basic UpdateBufferingSettings SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens TeleControl Server Basic. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2025-49468

A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via the idmodule parameter...

CVE-2025-49467

A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges...

CVE-2024-56158

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. Thi...

CVE-2024-44905

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/appendvalue.go...

CVE-2024-44906

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15...

CVE-2025-49468

A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via the idmodule parameter...

CVE-2025-49468

The CVE-2025-49468 entry describes a SQL injection in the No Boss Calendar Joomla extension (versions prior to 5.0.7). The vulnerability allows remote authenticated users to execute arbitrary SQL via the id_module parameter. Impact is reported as high for confidentiality, integrity, and availabil...

CVE-2025-49468 Joomla Extension - nobossextensions.com - SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla

A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via the idmodule parameter...

Automattic: Woocommerce SQL Injection in WC_Report_Coupon_Usage

A SQL injection vulnerability was found in the WooCommerce plugin version 9.9.3. The vulnerable parameter was 'couponcodes' in the '/wp-admin/admin.php?page=wc-reports&tab=orders&report=couponusage' endpoint. The vulnerability required the privilege to view reports...

PT-2025-29177 · Advantech · Advantech Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A SQL injection issue exists in Advantech iView, potentially allowing an authenticated attacker with user-level privileges to disclose information or cause a denial-of-service...

WordPress Infility Global SQL Injection Vulnerability

WordPress Infility Global is a plugin for managing the global settings of your WordPress website. WordPress Infility Global suffers from a SQL injection vulnerability. The vulnerability stems from improper neutralization of special elements and can be exploited by an attacker to read or modify...

XWiki allows SQL injection in query endpoint of REST API with Oracle

Impact It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. Patches This has been patched ...

uptrace pgdriver SQL injection vulnerability

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15...