CVE-2025-24368

Cacti is an open source performance and fault management framework. Some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in buildruleitemfilter function from lib/apiautomation.php, resulting in SQL injection. This vulnerability ...

CVE-2025-24368 Cacti has a SQL Injection vulnerability when using tree rules through Automation API

Cacti is an open source performance and fault management framework. Some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in buildruleitemfilter function from lib/apiautomation.php, resulting in SQL injection. This vulnerability ...

CVE-2024-54146

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29...

CVE-2024-54145

CVE-2024-54145 affects Cacti, an open source network monitoring framework. The vulnerability is a SQL injection in the get_discovery_results function of automation_devices.php triggered by the network parameter, allowing an attacker to potentially read/modify data.remediation: the issue is fixed ...

CVE-2024-54145 Cacti has a SQL Injection vulnerability when request automation devices

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the getdiscoveryresults function of automationdevices.php using the network parameter. This vulnerability is fixed in 1.2.29...

CVE-2024-54146 Cacti has a SQL Injection vulnerability when view host template

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29...

CVE-2024-54146 Cacti has a SQL Injection vulnerability when view host template

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29...

CVE-2024-13680

Summary: CVE-2024-13680 affects the WordPress plugin Form Builder CP (shortcode CP_EASY_FORM_WILL_APPEAR_HERE) and describes an SQL Injection in the id parameter across versions up to 1.2.41 due to insufficient escaping and lack of query parameterization. Impact (as stated): Authenticated attacke...

CVE-2024-49303

CVE-2024-49303 : SQL injection in the WordPress plugin Hero Mega Menu - Responsive WordPress Menu Plugin . Affected: versions

CVE-2024-13230

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2025-0565 ZZCMS index.php sql injection

A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and ma...

CVE-2024-57034

WeGIA 3.2.0 is vulnerable to SQL Injection in querygeracaoauto.php via the query parameter...

CVE-2024-57034

WeGIA 3.2.0 is vulnerable to SQL Injection in querygeracaoauto.php via the query parameter...

CVE-2024-57035

WeGIA v3.2.0 is vulnerable to SQL Injection viathe nextPage parameter in /controle/control.php...

CVE-2024-57035

WeGIA v3.2.0 is vulnerable to SQL Injection viathe nextPage parameter in /controle/control.php...

PT-2025-3562 · Jfinaloa · Jfinaloa

Name of the Vulnerable Software and Affected Versions: JFinalOA versions prior to v2025.01.01 Description: The issue is a SQL injection vulnerability via the component validRoleKey?sysRole.key. This vulnerability allows for the injection of malicious SQL code, potentially leading to unauthorized...

CVE-2025-0486

CVE-2025-0486 affects Fanli2012 native-php-cms 1.0. The vulnerability lies in the /fladmin/login.php file, where manipulating the username parameter enables SQL injection. It is exploitable remotely and has been disclosed publicly. Multiple sources corroborate the issue with high impact across co...

CVE-2025-0407

A vulnerability was found in liujianview gymxmjpa 1.0. It has been declared as critical. Affected by this vulnerability is the function EquipmentDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/EquipmentController.java. The manipulation of the argument hyname leads to sql...

CVE-2023-42241

Vulnerability summary: Selesta Visual Access Manager (VAM) prior to 4.42.2 contains a SQL injection in multiple POST parameters of /vam/vam_anagraphic.php (authenticated access required). This is confirmed across multiple sources (Red Hat advisory, CVE entries, CNVD, CNNVD, CIRCL). Affected versi...

CVE-2025-21628

Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of queryoperator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by addi...