270497 matches found
CVE-2025-67406
https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code remote. The component is: control/activatecase.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activatecase.php in parameter id...
CVE-2025-69943
The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection within the get_doctor.php file. The vulnerability is triggered via the doctor and specilizationid parameters. This flaw allows for the improper neutralization of special elements used in an SQL command, potentially leadi...
PT-2026-65921
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update student.php via parameters fname and student class...
PT-2026-65705
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-51992
This CVE ID is rejected or withdrawn by its CVE Numbering Authority and does not represent an active vulnerability entry.
CVE-2025-65340
The kishan0725 Hospital Management System 4.0 is vulnerable to an SQL Injection flaw located in the /betweendates-detailsreports.php component. This vulnerability allows for the improper neutralization of special elements used in an SQL command. While a proof of concept (PoC) is noted in the secu...
CVE-2025-67406
The Advocate office management system 1.0 is vulnerable to a SQL Injection flaw in the activate_case.php component. The root cause is the direct interpolation of unsanitized user input from the id parameter into an SQL query. Attackers can exploit this via a GET request to the control/activate_ca...
CVE-2025-67407
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatestudent.php via parameters fname and studentclass...
CVE-2025-67403
The Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection within the update_class.php file. The vulnerability is triggered via the class_name parameter, which fails to properly neutralize special elements used in SQL commands. This flaw allows an attacker to execute ...
PT-2026-65922
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save user.php via the parameter status...
CVE-2025-67408: Improper Neutralization of Special Elements used in an SQL Command
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /saveuser.php via the parameter status...
CVE-2026-11973: Improper Neutralization of Special Elements used in an SQL Command
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-63234: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63233: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2026-63230: Improper Neutralization of Special Elements used in an SQL Command
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...
CVE-2025-67403
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updateclass.php via the parameter classname...
PT-2026-65783
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...
PT-2026-65912
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1...
RHEL 10 : mariadb-connector-c (RHSA-2026:47772)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47772 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes:...
