Total
18012 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-8439 | 1 Anisha | 1 Wazifa System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0. This issue affects some unknown processing of the file /controllers/updatesettings.php. The manipulation of the argument Password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8441 | 1 Anisha | 1 Online Medicine Guide | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /pharsignup.php. The manipulation of the argument phuname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8442 | 1 Anisha | 1 Online Medicine Guide | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cussignup.php. The manipulation of the argument uname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8443 | 1 Anisha | 1 Online Medicine Guide | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument uname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8494 | 1 Carmelo | 1 Intern Membership Management System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /admin/delete_student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2024-43436 | 1 Moodle | 1 Moodle | 2025-08-05 | N/A | 7.2 HIGH |
|
A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.
|
|||||
| CVE-2025-8466 | 1 Anisha | 1 Online Farm System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /forgot_passfarmer.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8467 | 1 Anisha | 1 Wazifa System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was found in code-projects Wazifa System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /controllers/regcontrol.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8468 | 1 Anisha | 1 Wazifa System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /controllers/reset.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8469 | 1 Fabian | 1 Online Hotel Reservation System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/deletegallery.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8470 | 1 Fabian | 1 Online Hotel Reservation System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/deleteroom.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8471 | 1 Projectworlds | 1 Online Admission System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of the file /adminlogin.php. The manipulation of the argument a_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8493 | 1 Carmelo | 1 Intern Membership Management System | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_student_query.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8499 | 1 Anisha | 1 Online Medicine Guide | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cusfindambulence2.php. The manipulation of the argument Search leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8502 | 1 Anisha | 1 Online Medicine Guide | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Affected by this vulnerability is an unknown functionality of the file /changepass.php. The manipulation of the argument ups leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-8503 | 1 Anisha | 1 Online Medicine Guide | 2025-08-05 | 7.5 HIGH | 7.3 HIGH |
|
A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Affected by this issue is some unknown functionality of the file /adaddmed.php. The manipulation of the argument mname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
|
|||||
| CVE-2025-50341 | 2025-08-05 | N/A | 9.8 CRITICAL | ||
|
A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter. An attacker can manipulate the SQL query logic and determine true/false conditions, potentially leading to data exposure or further exploitation.
|
|||||
| CVE-2025-40682 | 1 Oretnom23 | 1 Human Resource Management System | 2025-08-04 | N/A | 9.8 CRITICAL |
|
SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.
|
|||||
| CVE-2024-52538 | 1 Dell | 2 Avamar Data Store, Avamar Server | 2025-08-04 | N/A | 7.6 HIGH |
|
Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
|
|||||
| CVE-2024-47977 | 1 Dell | 2 Avamar Data Store, Avamar Server | 2025-08-04 | N/A | 7.1 HIGH |
|
Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
|
|||||
| CVE-2024-47484 | 1 Dell | 2 Avamar Data Store, Avamar Server | 2025-08-04 | N/A | 8.2 HIGH |
|
Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
|
|||||
| CVE-2024-29227 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29230 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29232 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29233 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29234 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29235 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29236 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29237 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29238 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2024-29239 | 1 Synology | 2 Diskstation Manager, Surveillance Station | 2025-08-04 | N/A | 5.4 MEDIUM |
|
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
|
|||||
| CVE-2025-52390 | 2025-08-04 | N/A | 9.1 CRITICAL | ||
|
Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `FulltextSearch.class.php`. The application directly concatenates user-supplied input (`$search_word`) into SQL queries without sanitization, allowing attackers to manipulate the SQL logic and potentially extract sensitive information or escalate their privileges.
|
|||||
| CVE-2025-50868 | 2025-08-04 | N/A | 6.5 MEDIUM | ||
|
A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before being used in SQL queries.
|
|||||
| CVE-2025-45809 | 1 Litellm | 1 Litellm | 2025-08-01 | N/A | 5.4 MEDIUM |
|
BerriAI litellm v1.65.4 was discovered to contain a SQL injection vulnerability via the /key/block endpoint.
|
|||||
| CVE-2025-53515 | 1 Advantech | 1 Iview | 2025-08-01 | N/A | 8.8 HIGH |
|
A vulnerability exists in Advantech iView that allows for SQL injection
and remote code execution through NetworkServlet.archiveTrap(). This
issue requires an authenticated attacker with at least user-level
privileges. Certain input parameters are not sanitized, allowing an
attacker to perform SQL injection and potentially execute code in the
context of the 'nt authority\local service' account.
|
|||||
| CVE-2025-30217 | 1 Frappe | 1 Frappe | 2025-08-01 | N/A | 7.5 HIGH |
|
Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available.
|
|||||
| CVE-2025-30212 | 1 Frappe | 1 Frappe | 2025-08-01 | N/A | 7.5 HIGH |
|
Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.
|
|||||
| CVE-2025-41377 | 2025-08-01 | N/A | N/A | ||
|
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php.
|
|||||
| CVE-2023-37847 | 1 Xxyopen | 1 Novel-plus | 2025-08-01 | N/A | 9.8 CRITICAL |
|
novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
|
|||||
| CVE-2024-1251 | 1 Tongda2000 | 1 Office Anywhere | 2025-08-01 | 5.2 MEDIUM | 5.5 MEDIUM |
|
A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-252990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
|
|||||