CWE-74

SQL injection in code-projects Simple Laundry System 1.0 allows remote unauthenticated attackers to manipulate the userid parameter in /userchecklogin.php, enabling arbitrary SQL query execution with potential impact on data confidentiality, integrity, and availability. CVSS 6.9 reflects low-impact confidentiality, integrity, and availability effects without lateral propagation; exploit code is publicly available, increasing practical risk despite moderate CVSS scoring.

SQL injection in itsourcecode Construction Management System 1.0 via the Home parameter in /borrowed_tool_report.php allows authenticated remote attackers to execute arbitrary SQL queries with limited impact on confidentiality, integrity, and availability. The vulnerability has a public exploit and CVSS score of 5.3, making it a moderate-severity issue requiring authentication but presenting real exploitation risk given POC availability.

SQL injection in PHPGurukul Online Course Registration 3.1 allows unauthenticated remote attackers to manipulate the cid parameter in /check_availability.php to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification. Publicly available exploit code exists, elevating real-world risk despite moderate CVSS scoring.

SQL injection in PowerJob 5.1.0 through 5.1.2 allows remote attackers to execute arbitrary SQL queries via the customQuery parameter in the detailPlus endpoint of InstanceController.java, potentially enabling unauthorized data access or modification. The vulnerability is remotely exploitable without authentication (CVSS 6.9, EPSS P), with a GitHub pull request indicating a fix is under review but not yet released as a patched version.

SQL injection in itsourcecode Construction Management System 1.0 allows authenticated remote attackers to manipulate the 'emp' parameter in /borrowed_tool.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability requires valid credentials (PR:L) but has publicly available exploit code, though exploitation probability remains moderate (EPSS indicates P:P status). This is a classic parameter injection flaw in a PHP application with real but constrained risk due to authentication requirements.

SQL injection in code-projects Simple IT Discussion Forum 1.0 via the cat_id parameter in /edit-category.php allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or deletion. The vulnerability has a publicly disclosed exploit and moderate CVSS score (6.9) with confirmed exploitation capability signals.

NestJS Core's Server-Sent Events (SSE) stream handler fails to sanitize newline characters in message type and ID fields, allowing remote attackers to inject arbitrary SSE events, spoof event types, and corrupt client reconnection state. Affected versions prior to @nestjs/[email protected] are vulnerable when developers map user-controlled data to SSE message type or id fields. This mirrors a vulnerability patched in Spring Framework and can lead to event spoofing, data injection with XSS potential, and reconnection state corruption if client applications render SSE data without additional sanitization.

SQL injection in Cyber-III Student-Management-System login parameter handler allows unauthenticated remote attackers to execute arbitrary SQL queries via the Password parameter in /login.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and the affected project uses rolling releases without fixed version tagging, complicating patch status determination. CVSS 6.9 reflects moderate severity with low confidentiality, integrity, and availability impact across multiple scopes.

SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the firstName parameter in /userfinishregister.php, enabling data exfiltration and manipulation. The vulnerability has publicly available exploit code and a published CVSS 6.9 score reflecting moderate confidentiality and integrity impact.

SQL injection in zhongyu09 openchatbi up to version 0.2.1 allows authenticated remote attackers to manipulate the keywords argument in the Multi-stage Text2SQL Workflow component, leading to unauthorized database access with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.