CVE-2026-115324

The mem0 library, versions 0.1.117 before 1.0.8 , is vulnerable to an SQL injection in the mem0/vector_stores/databricks.py component. The root cause is the use of unescaped string interpolation within insert() and update() functions. Attackers can exploit this by supplying crafted memory text, m...

CVE-2025-71434

Weaver E-cology versions 8.0 , 9.0 , and 10.0 (prior to 10.76 ) are vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists in the /api/doc/out/more/list endpoint via the elementmore parameter when srcType=2. Attackers can inject SQL commands through the doc_datefrom and doc...

CVE-2025-71434 Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/count...

EUVD-2025-211171

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/count...

CVE-2024-58393

The i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) is vulnerable to an SQL injection flaw. Unauthenticated attackers can manipulate database queries by sending GET requests to /product-details.php using boolean-based , stacked , or time-based SLEEP payloads in the 'id' paramete...

EUVD-2024-55820

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

CVE-2022-51023

PHPOK versions 4.5.000 before 5.4.081 are vulnerable to an SQL injection vulnerability. The root cause is the improper handling of the sort parameter , which allows unauthenticated attackers to manipulate ORDER BY clauses. By sending GET requests to /api.php?c=project&f=index using extractvalue p...

EUVD-2022-56067

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

EUVD-2022-56075

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

CVE-2022-51021 NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

CVE-2022-51021

The NotificationX plugin for WordPress (versions 2.0.0 before 2.3.12) is vulnerable to an unauthenticated SQL injection . An attacker can manipulate database queries by supplying an array-form id parameter to the /wp-json/notificationx/v1/notification/{id} endpoint. Specifically, passing id[1] wi...

EUVD-2019-20209

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2019-25778 SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2019-25778

Versions of SeaCMS through 8.7 are vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists in the rlist[] array parameter , which allows remote attackers to manipulate database queries. By sending crafted GET requests to /comment/api/index.php using backtick-quoted variables...

CVE-2025-8971

CVE-2025-8971 SQL Injection Author: Byte Reaper Description : This exploit for CVE-2025-8971, a SQL injection vulnerability in itsourcecode Online Tour and Travel Management System 1.0. The vulnerability exists in /admin/operations/travellers.php and can be exploited remotely via the val-username...

CVE-2026-112327

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11...

WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Product Filter by WBW versions = 3.4.6...

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Noverdi Anugrah Ramadhan in WordPress Plugin Newsletters versions = 4.18.1...

CVE-2026-112327

The TMS Amelia (ameliabooking) WordPress plugin is vulnerable to a SQL Injection flaw (CWE-89) in versions 2.4.11 and below . The issue stems from the improper neutralization of special elements used in an SQL command, potentially allowing an attacker to execute arbitrary SQL queries. This vulner...

EUVD-2026-108054

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11...