PT-2025-9192 · Zj1983 Zz · Zj1983 Zz

Name of the Vulnerable Software and Affected Versions: zj1983 zz up to 2024-8 Description: A critical vulnerability has been found in the function getOaWid of the file src/main/java/com/futvan/z/system/zworkflow/ZworkflowAction.java. The manipulation of the argument tableId leads to SQL injection...

Moodle SQL Injection Vulnerability

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from an SQL injection vulnerability that stems from not adequately filtering user input. No detailed...

CVE-2025-25516

Seacms =13.3 is vulnerable to SQL Injection in adminpaylog.php...

CVE-2025-27135

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available...

PT-2025-7940 · Posthog · Posthog

Name of the Vulnerable Software and Affected Versions: PostHog affected versions not specified Description: The issue concerns a SQL injection vulnerability in PostHog's ClickHouse table functions, potentially leading to remote code execution. Recommendations: At the moment, there is no informati...

CVE-2025-25520

Seacms 13.3 is vulnerable to SQL Injection in adminpay.php...

Joomla! 5.x < 5.2.4 SQL injection

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.x prior to 4.4.11 or 5.x prior to 5.2.4. It is, therefore, affected by a SQL injection vulnerability in the backend task list of comscheduler due to improperly built order clauses. Note that the...

CVE-2025-25519

Seacms =13.3 is vulnerable to SQL Injection in adminzyk.php...

CVE-2025-25521

Seacms =13.3 is vulnerable to SQL Injection in admintypenews.php...

CVE-2025-25517

CVE-2025-25517 affects SeaCMS/Seacms versions up to 13.3, with a SQL Injection vulnerability in admin_reslib.php. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-accessible, unauthenticated, no-user-interaction, high-impact flaw, affecting confidentiality, integrity,...

CVE-2025-25521

Seacms =13.3 is vulnerable to SQL Injection in admintypenews.php...

CVE-2025-1583

CVE-2025-1583 is a SQL injection vulnerability affecting PHPGurukul Online Nurse Hiring System 1.0, located in /admin/search-report-details.php where the searchinput parameter is manipulated. The issue enables remote exploitation, and multiple sources report that the exploit has been disclosed pu...

CVE-2025-25876

A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL injection to obtain sensitive data...

CVE-2024-54960

A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component...

CVE-2024-13491

The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 4.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

exim -- SQL injection

[email protected] reports: Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection...

PT-2025-7581 · Itsourcecode · Itsourcecode Simple Chatbox

Name of the Vulnerable Software and Affected Versions: ITSourcecode Simple ChatBox versions up to 1.0 Description: A vulnerability was found in ITSourcecode Simple ChatBox, affecting unknown code of the file /del.php. The attack can use SQL injection to obtain sensitive data. Recommendations: For...

CVE-2025-26605

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, deletarcargo.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access...

CVE-2025-1135 SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php

A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the BatchWinnerEntry functionality. The CurrentFundraiser parameter is directly concatenated into an SQL...

CVE-2025-26610

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, restaurarprodutodesocultar.php endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowin...