CVE-2025-41407

Zohocorp ManageEngine ADAudit Plus, prior to version 8511, has a SQL injection vulnerability in the OU History report. Root cause: improper handling of input in the OU History reporting path leading to SQL injection. Impact: potential unauthorized access or data disclosure from affected installat...

CVE-2024-42561

Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoicenumber parameter at salesreport.php...

CVE-2024-42569

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php...

CVE-2024-42554

Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the roomtype parameter at adminroomadded.php...

CVE-2024-42572

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php...

CVE-2024-42567

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2...

CVE-2024-42558

Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the bookid parameter at adminmodifyroom.php...

CVE-2025-36527 SQL Injection

Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports...

CVE-2024-41236

A SQL injection vulnerability in /smsa/adminlogin.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter of the Admin Login Page...

CVE-2024-6919

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection. This issue affects NACPremium: through 01082024...

CVE-2024-42575

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php...

CVE-2024-42562

Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoicenumber parameter at preview.php...

CVE-2024-42566

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php...

CVE-2024-40539

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user...

CVE-2024-40540

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept...

CVE-2024-40498

SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the register.php...

CVE-2024-28297

SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2024-28298

SQL injection vulnerability in BM SOFT BMPlanning 1.0.0.1 allows authenticated users to execute arbitrary SQL commands via the SECIDF, LIEIDF, PLANFIDF, CLIIDF, DOSIDF, and possibly other parameters to /BMServerR.dll/BMRest...

CVE-2024-28322

SQL Injection vulnerability in /event-management-master/backend/register.php in PuneethReddyHC Event Management 1.0 allows attackers to run arbitrary SQL commands via the eventid parameter in a crafted POST request...

CVE-2024-3265

The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations...