Total
18012 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-10599 | 1 Itsourcecode | 1 Web-based Internet Laboratory Management System | 2025-09-22 | 7.5 HIGH | 7.3 HIGH |
|
A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the file login.php. Performing manipulation of the argument user_email results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
|
|||||
| CVE-2025-10601 | 1 Janobe | 1 Online Exam Form Submission | 2025-09-22 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. Affected is an unknown function of the file /admin/index.php. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-29892 | 1 Qnap | 1 Qsync Central | 2025-09-20 | N/A | 8.8 HIGH |
|
An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.6 ( 2025/03/20 ) and later
|
|||||
| CVE-2025-52044 | 1 Frappe | 1 Erpnext | 2025-09-20 | N/A | 7.5 HIGH |
|
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventory_dimensions_dict parameter.
|
|||||
| CVE-2025-52048 | 1 Frappe | 1 Frappe | 2025-09-20 | N/A | 6.5 MEDIUM |
|
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker to extract information from databases by injecting a SQL query into the `dt` parameter.
|
|||||
| CVE-2025-10436 | 1 Campcodes | 1 Computer Sales And Inventory System | 2025-09-20 | 7.5 HIGH | 7.3 HIGH |
|
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/sup_searchfrm.php?action=edit. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
|
|||||
| CVE-2025-10448 | 1 Campcodes | 1 Online Job Finder System | 2025-09-20 | 7.5 HIGH | 7.3 HIGH |
|
A flaw has been found in Campcodes Online Job Finder System 1.0. This affects an unknown function of the file /index.php?q=result&searchfor=bycompany. This manipulation of the argument Search causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
|
|||||
| CVE-2025-57104 | 1 Zeon | 1 Teampel | 2025-09-20 | N/A | 5.4 MEDIUM |
|
Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx.
|
|||||
| CVE-2025-10613 | 1 Facebook-julykringcadayona | 1 Student Information System | 2025-09-20 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such manipulation of the argument level_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-10617 | 1 Razormist | 1 Online Polling System | 2025-09-20 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A weakness has been identified in SourceCodester Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/positions.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
|
|||||
| CVE-2025-10618 | 1 Angeljudesuarez | 1 Online Clinic Management System | 2025-09-20 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file transact.php. Such manipulation of the argument firstname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Other parameters might be affected as well.
|
|||||
| CVE-2025-10603 | 1 Emiloi | 1 Online Discussion Forum | 2025-09-20 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was determined in PHPGurukul Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_forum/search_result.php. Executing manipulation of the argument Search can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
|
|||||
| CVE-2025-10625 | 1 Janobe | 1 Online Exam Form Submission | 2025-09-20 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability was detected in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /user/dashboard.php?page=update_profile. The manipulation of the argument phone results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. Other parameters might be affected as well.
|
|||||
| CVE-2025-10626 | 1 Janobe | 1 Online Exam Form Submission | 2025-09-20 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A flaw has been found in SourceCodester Online Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /admin/update_s3.php. This manipulation of the argument credits causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
|
|||||
| CVE-2025-10627 | 1 Janobe | 1 Online Exam Form Submission | 2025-09-20 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /admin/delete_user.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-10663 | 1 Phpgurukul | 1 Online Course Registration | 2025-09-20 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation of the argument cgpa results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
|
|||||
| CVE-2025-10667 | 1 Emiloi | 1 Online Discussion Forum | 2025-09-20 | 7.5 HIGH | 7.3 HIGH |
|
A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /members/compose_msg.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
|
|||||
| CVE-2025-10620 | 1 Angeljudesuarez | 1 Online Clinic Management System | 2025-09-20 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A flaw has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file /editp2.php. Executing manipulation of the argument id/firstname/lastname/type/age/address can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
|
|||||
| CVE-2025-10687 | 1 Jkev | 1 Responsive E-learning System | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was found in SourceCodester Responsive E-Learning System 1.0. This affects an unknown part of the file /admin/add_teacher.php. The manipulation of the argument Username results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
|
|||||
| CVE-2025-10673 | 1 Itsourcecode | 1 Student Information Management System | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/modules/class/index.php. This manipulation of the argument classId causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
|
|||||
| CVE-2025-10624 | 1 Phpgurukul | 1 User Management System | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A security flaw has been discovered in PHPGurukul User Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument emailid results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
|
|||||
| CVE-2025-10662 | 1 Seacms | 1 Seacms | 2025-09-19 | 5.8 MEDIUM | 4.7 MEDIUM |
|
A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This affects another injection point than CVE-2025-25513.
|
|||||
| CVE-2025-10664 | 1 Phpgurukul | 1 Small Crm | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was determined in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /create-ticket.php. Executing manipulation of the argument subject can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
|
|||||
| CVE-2024-26026 | 1 F5 | 1 Big-ip Next Central Manager | 2025-09-19 | N/A | 7.5 HIGH |
|
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
|
|||||
| CVE-2024-21793 | 1 F5 | 1 Big-ip Next Central Manager | 2025-09-19 | N/A | 7.5 HIGH |
|
An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
|
|||||
| CVE-2025-10668 | 1 Emiloi | 1 Online Discussion Forum | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A security vulnerability has been detected in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file /members/compose_msg_admin.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
|
|||||
| CVE-2025-10670 | 1 Emiloi | 1 E-logbook With Health Monitoring System For Covid-19 | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A flaw has been found in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /check_profile.php. Executing manipulation of the argument profile_id can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
|
|||||
| CVE-2025-10421 | 1 Oretnom23 | 1 Student Grading System | 2025-09-19 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A flaw has been found in SourceCodester Student Grading System 1.0. This vulnerability affects unknown code of the file /update_account.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
|
|||||
| CVE-2025-10420 | 1 Oretnom23 | 1 Student Grading System | 2025-09-19 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability was detected in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /form137.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
|
|||||
| CVE-2025-10419 | 1 Oretnom23 | 1 Student Grading System | 2025-09-19 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A security vulnerability has been detected in SourceCodester Student Grading System 1.0. Affected by this issue is some unknown functionality of the file /del_promote.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
|
|||||
| CVE-2025-10418 | 1 Oretnom23 | 1 Student Grading System | 2025-09-19 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A weakness has been identified in SourceCodester Student Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_students.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
|
|||||
| CVE-2025-10417 | 1 Campcodes | 1 Grocery Sales And Inventory System | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=delete_product. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
|
|||||
| CVE-2025-10445 | 1 Campcodes | 1 Computer Sales And Inventory System | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/us_transac.php?action=add. Executing manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.
|
|||||
| CVE-2025-10446 | 1 Campcodes | 1 Computer Sales And Inventory System | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_searchfrm.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
|
|||||
| CVE-2025-10444 | 1 Campcodes | 1 Online Job Finder System | 2025-09-19 | 7.5 HIGH | 7.3 HIGH |
|
A security flaw has been discovered in Campcodes Online Job Finder System 1.0. This issue affects some unknown processing of the file /advancesearch.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
|
|||||
| CVE-2014-0763 | 1 Advantech | 1 Advantech Webaccess | 2025-09-19 | 7.5 HIGH | N/A |
|
An attacker using SQL injection may use arguments to construct queries
without proper sanitization. The DBVisitor.dll is exposed through SOAP
interfaces, and the exposed functions are vulnerable to SOAP injection.
This may allow unexpected SQL action and access to records in the table
of the software database or execution of arbitrary code.
|
|||||
| CVE-2025-0558 | 1 Tduckcloud | 1 Tduck-platform | 2025-09-19 | 6.5 MEDIUM | 6.3 MEDIUM |
|
A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThemeRequest of the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java. The manipulation of the argument color leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
|
|||||
| CVE-2025-29894 | 1 Qnap | 1 Qsync Central | 2025-09-19 | N/A | 8.8 HIGH |
|
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
|
|||||
| CVE-2025-29893 | 1 Qnap | 1 Qsync Central | 2025-09-19 | N/A | 8.8 HIGH |
|
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
|
|||||
| CVE-2025-10712 | 2025-09-19 | 7.5 HIGH | 7.3 HIGH | ||
|
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.php/Login/login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
|
|||||