Total
18012 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-25638 | 4 Debian, Hibernate, Oracle and 1 more | 5 Debian Linux, Hibernate Orm, Communications Cloud Native Core Console and 2 more | 2025-04-23 | 5.8 MEDIUM | 7.4 HIGH |
|
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
|
|||||
| CVE-2024-34780 | 1 Ivanti | 1 Endpoint Manager | 2025-04-23 | N/A | 7.2 HIGH |
|
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
|
|||||
| CVE-2025-26852 | 1 Descor | 1 Infocad | 2025-04-23 | N/A | 10.0 CRITICAL |
|
DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.
|
|||||
| CVE-2025-28009 | 1 Appventure | 1 Dietiqa | 2025-04-23 | N/A | 9.8 CRITICAL |
|
A SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20.
|
|||||
| CVE-2025-29180 | 1 Foxcms | 1 Foxcms | 2025-04-23 | N/A | 7.2 HIGH |
|
In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering.
|
|||||
| CVE-2025-29181 | 1 Foxcms | 1 Foxcms | 2025-04-23 | N/A | 7.2 HIGH |
|
FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.
|
|||||
| CVE-2023-4776 | 1 Igexsolutions | 1 Wpschoolpress | 2025-04-23 | N/A | 8.8 HIGH |
|
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
|
|||||
| CVE-2023-49954 | 1 3cx | 1 3cx | 2025-04-23 | N/A | 9.8 CRITICAL |
|
The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.
|
|||||
| CVE-2023-34133 | 1 Sonicwall | 2 Analytics, Global Management System | 2025-04-23 | N/A | 7.5 HIGH |
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
|
|||||
| CVE-2024-4307 | 1 Ofofonobsdev | 1 Hubbank | 2025-04-23 | N/A | 8.1 HIGH |
|
SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/accounts/activities.php?id=1, /accounts/view-deposit.php?id=1, /accounts/view_cards. php?id=1, /accounts/wire-transfer.php?id=1 and /accounts/wiretransfer-pending.php?id=1, id parameter) and retrieve the information stored in the database.
|
|||||
| CVE-2024-4309 | 1 Ofofonobsdev | 1 Hubbank | 2025-04-23 | N/A | 8.1 HIGH |
|
SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/user/transaction.php?id=1, /user/credit-debit_transaction.php?id=1,/user/view_transaction. php?id=1 and /user/viewloantrans.php?id=1, id parameter) and retrieve the information stored in the database.
|
|||||
| CVE-2023-24204 | 1 Oretnom23 | 1 Simple Customer Relationship Management System | 2025-04-23 | N/A | 5.4 MEDIUM |
|
SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code via the name parameter in get-quote.php.
|
|||||
| CVE-2025-27892 | 1 Shopware | 1 Shopware | 2025-04-23 | N/A | 6.8 MEDIUM |
|
Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.
|
|||||
| CVE-2025-3676 | 1 Xxyopen | 1 Novel-plus | 2025-04-23 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
|
|||||
| CVE-2022-3711 | 1 Sophos | 2 Xg Firewall, Xg Firewall Firmware | 2025-04-23 | N/A | 4.3 MEDIUM |
|
A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA.
|
|||||
| CVE-2022-45010 | 1 Simple Phone Book\/directory Web App Project | 1 Simple Phone Book\/directory Web App | 2025-04-23 | N/A | 9.8 CRITICAL |
|
Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit.php.
|
|||||
| CVE-2022-44838 | 1 Automotive Shop Management System Project | 1 Automotive Shop Management System | 2025-04-23 | N/A | 7.2 HIGH |
|
Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_service.php.
|
|||||
| CVE-2022-44790 | 1 Interspire | 1 Email Marketer | 2025-04-23 | N/A | 7.5 HIGH |
|
Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the database if the survey id exists.
|
|||||
| CVE-2025-3174 | 1 Projectworlds | 1 Online Lawyer Management System | 2025-04-23 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability has been found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2024-44817 | 1 Zzcms | 1 Zzcms | 2025-04-23 | N/A | 8.8 HIGH |
|
SQL Injection vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the id parameter in the adv2.php component.
|
|||||
| CVE-2024-11242 | 1 Zzcms | 1 Zzcms | 2025-04-23 | 5.8 MEDIUM | 4.7 MEDIUM |
|
A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ad_list.php?action=pass of the component Keyword Filtering. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-3245 | 1 Angeljudesuarez | 1 Library Management System | 2025-04-23 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability was found in itsourcecode Library Management System 1.0. It has been rated as critical. Affected by this issue is the function Search of the file library_management/src/Library_Management/Forgot.java. The manipulation of the argument txtuname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2024-37858 | 1 Oretnom23 | 1 Lost And Found Information System | 2025-04-23 | N/A | 9.8 CRITICAL |
|
SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php.
|
|||||
| CVE-2024-37857 | 1 Oretnom23 | 1 Lost And Found Information System | 2025-04-23 | N/A | 8.8 HIGH |
|
SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via id parameter to php-lfis/admin/categories/view_category.php.
|
|||||
| CVE-2024-40402 | 1 Nikhil-bhalerao | 1 Simple Library Management System | 2025-04-23 | N/A | 6.3 MEDIUM |
|
A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries.
|
|||||
| CVE-2025-43949 | 2025-04-23 | N/A | 9.8 CRITICAL | ||
|
MuM (aka Mensch und Maschine) MapEdit (aka mapedit-web) 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that control a web application's database server.
|
|||||
| CVE-2022-44393 | 1 Sanitization Management System Project | 1 Sanitization Management System | 2025-04-23 | N/A | 7.2 HIGH |
|
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=.
|
|||||
| CVE-2025-3767 | 2025-04-23 | N/A | 7.2 HIGH | ||
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.
This page is only accessible to authenticated users with high privileges.
This issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.
|
|||||
| CVE-2025-23176 | 2025-04-23 | N/A | 8.8 HIGH | ||
|
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
|
|||||
| CVE-2024-46078 | 1 Adonesevangelista | 1 Sports Management System | 2025-04-23 | N/A | 7.5 HIGH |
|
itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduling/player.php via the argument id.
|
|||||
| CVE-2024-48356 | 1 Lylme | 1 Lylme Spage | 2025-04-22 | N/A | 9.8 CRITICAL |
|
LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.
|
|||||
| CVE-2024-48573 | 1 Aquila-cms | 1 Aquilacms | 2025-04-22 | N/A | 9.8 CRITICAL |
|
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature.
|
|||||
| CVE-2025-0532 | 1 Codezips | 1 Gym Management System | 2025-04-22 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/new_submit.php. The manipulation of the argument m_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-0535 | 1 Codezips | 1 Gym Management System | 2025-04-22 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem_submit.php. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-0565 | 1 Zzcms | 1 Zzcms | 2025-04-22 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2024-50766 | 1 Oretnom23 | 1 Survey Application System | 2025-04-22 | N/A | 9.8 CRITICAL |
|
SourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter.
|
|||||
| CVE-2025-3402 | 1 Seeyon | 1 Fe Collaborative Office Platform | 2025-04-22 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform 5.5.2 and classified as critical. This issue affects some unknown processing of the file /sysform/042/check.js%70. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
|
|||||
| CVE-2020-18243 | 1 Enricozab | 1 Cms | 2025-04-22 | N/A | 6.5 MEDIUM |
|
SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo-view-case.php.
|
|||||
| CVE-2025-28198 | 1 Hitstiresoftware | 1 Hitout Car Sale | 2025-04-22 | N/A | 5.9 MEDIUM |
|
A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component.
|
|||||
| CVE-2025-28100 | 1 Geeeeeeeek | 1 Dingfanzu | 2025-04-22 | N/A | 9.8 CRITICAL |
|
A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.php" id parameter.
|
|||||