PT-2026-65704

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2025-69942

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1...

CVE-2025-69943

kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in getdoctor.php via the parameters doctor and specilizationid...

CVE-2025-69945

The vulnerability is CVE-2025-69945 affecting Kishan0725 Hospital Management System 4.0, with a SQL Injection flaw in the web endpoint /doctor/edit-patient.php?editid=1. According to the provided data, the CVSS v3.1 base score is 7.3 (HIGH) with Network attack vector, Low confidentiality/integrit...

CVE-2025-67408

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /saveuser.php via the parameter status...

CVE-2026-51992

SQL Injection vulnerability in ClickHouse Server Versions = 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function...

CVE-2025-69945

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1...

PT-2026-65702

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

PT-2026-65703

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2025-67408

CVE-2025-67408 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is an SQL Injection in /save_user.php via the parameter status. Documented impact is partial confidentiality, integrity, and availability impact with a CVSS 3.1 base score of 7.3 (HIGH), attack vector N...

CVE-2025-67407

CVE-2025-67407 affects Sourcecodester CASAP Automated Enrollment System 1.0. The connected documents confirm a SQL Injection vulnerability in update_student.php triggered via the parameters fname and student_class . The CVSS 3.1 base metrics indicate a HIGH severity (7.3) with network attack vect...

CVE-2025-67405

CVE-2025-67405 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is a SQL Injection in update_password.php via the parameter new_password . This is the root cause, allowing unintended database queries. Documented impact shows low confidentiality, integrity, and avail...

EUVD-2025-210530

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php...

CVE-2025-67405

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...

CVE-2026-51992

SQL Injection vulnerability in ClickHouse Server Versions = 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function...

CVE-2025-67404

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...

CVE-2025-69949

CVE-2025-69949 affects Kishan0725 Hospital Management System 4.0. The vulnerability is a SQL Injection in check_availability.php exploitable via the parameters emailid and email. The CVSS 3.1 base score is 7.3 (High) with network attack vector, low attack complexity, no privileges required, and n...

CVE-2026-54658

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...

GHSA-6WCC-39RP-HH9P @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...