SQLi
Monthly
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been found in itsourcecode Billing System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0.php?action=delete_course. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in CodeAstro Gym Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Gym Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in itsourcecode Online Loan Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in SourceCodester Best House Rental Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the user supplied. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Blind SQL injection in the MasterStudy LMS WordPress plugin by Stylemix through version 3.6.27 allows high-privileged authenticated users to extract database contents via crafted requests to vulnerable admin-side parameters. The CVSS 3.1 score of 7.6 reflects a scope change (S:C), meaning successful exploitation reaches the shared WordPress database layer and can expose data belonging to core WordPress tables and co-installed plugins - not only LMS-specific records. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at 0.03% (10th percentile) confirming very low observed exploitation probability at time of analysis.
Blind SQL injection in Abis Technology BAPSIS versions prior to 202510271606 allows unauthenticated remote attackers to manipulate backend database queries over the network with no user interaction. The CVSS 9.8 rating reflects full compromise of confidentiality, integrity, and availability, though EPSS remains very low at 0.04% (13th percentile) and no public exploit identified at time of analysis. Disclosure originates from Turkey's national CERT (USOM), suggesting regional product exposure rather than mass-market footprint.
Remote unauthenticated SQL injection in Ghost Hot Spot's login form allows direct database manipulation and potential authentication bypass for versions up to 20251014, confirmed by published POC code. The extremely low EPSS score (0.03%, 7th percentile) contradicts technical exploitability metrics, suggesting limited real-world threat from this niche product. Vendor non-response precludes a timely security patch.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the `/admin/admin_football.php` endpoint to database manipulation via the unsanitized `pid` parameter, achievable by remote unauthenticated attackers per the CVSS 4.0 PR:N rating. The flaw enables limited read, write, and availability impact against the backend database. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS remains extremely low at 0.03% (8th percentile), consistent with this product's negligible real-world deployment footprint and no CISA KEV listing.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the `/admin/admin_product.php` endpoint to remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. Publicly available exploit code exists (GitHub CVE issue #16), though the EPSS score of 0.01% at the 1st percentile signals negligible observed exploitation probability - consistent with a niche, low-footprint hobbyist application. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin panel endpoint /admin/admin_feature.php to database manipulation via the unsanitized `pid` parameter. The provided CVSS 4.0 vector asserts PR:N (no privileges required), though the /admin/ path suggests authentication may be in play - this discrepancy is noted and should be verified against the actual application. A publicly available proof-of-concept exploit exists on GitHub, though the EPSS score of 0.01% (1st percentile) indicates real-world exploitation attempts remain negligible, consistent with the product's obscure deployment footprint. No vendor-released patch has been identified at time of analysis.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter in /admin/admin_index.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and minimal skill, and a public proof-of-concept exists on GitHub. Despite this, real-world risk is curtailed by the product's extremely niche deployment footprint, an EPSS of just 0.01% (1st percentile), and absence from CISA KEV - making mass exploitation implausible.
SQL injection in shawon100 RUET OJ through the ID parameter of /details.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The vulnerability affects commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code released. Despite moderate CVSS 2.1, the low EPSS score of 0.02% and requirement for prior authentication significantly limit real-world exploitation likelihood.
SQL injection in RUET OJ via the Name parameter in /contestproblem.php allows authenticated remote attackers to execute arbitrary SQL queries with limited impact on confidentiality and integrity. The vulnerability affects the rolling-release codebase up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, requires valid login credentials to exploit, and carries a very low CVSS score (2.1) despite publicly available exploit code, indicating minimal real-world risk due to authentication barriers and constrained database access.
SQL injection in RUET OJ /description.php endpoint allows authenticated remote attackers to manipulate the ID parameter and inject arbitrary SQL commands, achieving limited confidentiality and integrity compromise. The vulnerability affects the rolling-release version up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code disclosed. Despite the public disclosure, the extremely low EPSS score (0.02%) and high authentication barrier suggest minimal real-world exploitation risk, though the unresponsive vendor posture leaves the codebase unpatched.
SQL injection in RUET OJ's /process.php POST request handler allows remote unauthenticated attackers to manipulate the 'un' parameter to interact with the underlying database. The affected codebase, maintained by shawon100 on GitHub, uses no formal versioning - all commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 are affected. A public exploit has been disclosed via VulDB, though the EPSS score of 0.02% (6th percentile) reflects the product's extremely limited deployment footprint; no active exploitation is confirmed.
SQL injection in SourceCodester Best Salon Management System 1.0 exposes unauthenticated remote attackers to database manipulation via the `email` parameter in the `/panel/forgot-password.php` password recovery endpoint. A public proof-of-concept exploit has been disclosed, though EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate very low observed real-world exploitation. Impact is partial across confidentiality, integrity, and availability per the CVSS 4.0 scoring, consistent with a restricted database account context rather than full system compromise.
SQL injection in code-projects Courier Management System 1.0 exposes the /courier/edit-courier.php endpoint to unauthenticated remote attackers who can manipulate the OfficeName parameter to execute arbitrary SQL against the backend database. A publicly available exploit exists on GitHub (PoC by Abxery), though the EPSS score of 0.03% at the 8th percentile reflects negligible observed exploitation activity. The vulnerability is not listed in CISA KEV, consistent with the product's extremely limited production deployment footprint.
SQL injection in code-projects Food Ordering System 1.0 allows high-privileged remote attackers to manipulate the itemPrice parameter in /admin/menu.php, leading to limited data exposure and modification. The vulnerability requires administrative authentication and has publicly available exploit code, but carries low real-world exploitation risk due to administrative privilege requirement and minimal technical impact (CVSS 2.0, EPSS 0.03%).
SQL injection in code-projects Food Ordering System 1.0 allows remote attackers with high-level administrative privileges to execute arbitrary SQL commands via the itemID parameter in /admin/deleteitem.php. Despite public exploit availability, real-world risk is minimal due to requirement for authenticated administrator access and low CVSS impact scope (CVSS 2.0, EPSS 0.03%). The vulnerability affects only the administrative interface and does not escalate privileges or compromise confidentiality at scale.
SQL injection in Nero Social Networking Site 1.0 exposes the /friendprofile.php endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter. The CVSS 4.0 score of 5.5 reflects low-level confidentiality, integrity, and availability impact with no scope change to downstream systems. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.03% (8th percentile) indicates negligible observed exploitation activity, consistent with the product's extremely narrow deployment footprint as a PHP demo application.
SQL injection in Nero Social Networking Site 1.0 exposes the `/deletemessage.php` endpoint to unauthenticated remote attackers who can manipulate the `message_id` parameter to execute arbitrary SQL commands against the backend database. The affected product is a PHP-based hobbyist/academic application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0). A public proof-of-concept exploit has been released on GitHub, though EPSS remains at 0.03% (8th percentile), indicating negligible observed exploitation activity consistent with the product's near-zero production deployment footprint.
SQL injection in the /addfriend.php endpoint of Nero Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL against the underlying database. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.03% (8th percentile) indicates negligible observed in-the-wild activity. The product is a PHP-based academic demo application from code-projects.org, substantially limiting real-world exposure despite the straightforward attack vector.
SQL injection in Nero Social Networking Site 1.0 exposes the `/acceptoffres.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 score of 5.5 reflects partial confidentiality, integrity, and availability impact against the vulnerable system only, with no scope change to subsequent systems. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate exploitation has not been observed at meaningful scale, likely due to the product's extremely limited deployment footprint.
SQL injection in SourceCodester Point of Sales 1.0 via the ID parameter in /delete_category.php allows high-privilege remote attackers to manipulate database queries. The vulnerability requires administrative credentials (PR:H) but carries low confidentiality, integrity, and availability impact. Public exploit code exists, though EPSS score (0.03%) suggests limited real-world exploitation despite public availability.
SQL injection in SourceCodester Point of Sales 1.0 (by janobe) via the Category parameter in /category.php allows remote, unauthenticated attackers to manipulate backend database queries with no user interaction required. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation is straightforward and requires no privileges, though impact is limited (VC:L/VI:L/VA:L), indicating partial data exposure and manipulation rather than full system compromise. A publicly available proof-of-concept exists - reflected in the E:P threat modifier - yet the very low EPSS score of 0.03% (8th percentile) and absence from CISA KEV indicate no public exploit identified at time of analysis has driven widespread automated attacks.
SQL injection in SourceCodester Point of Sales 1.0 exposes the login endpoint (/index.php) to unauthenticated remote exploitation via a malicious Username parameter, enabling database query manipulation. A public proof-of-concept exploit has been disclosed on GitHub (CVE/issues/2), confirming the attack is reproducible. EPSS sits at 0.03% (8th percentile), indicating limited observed exploitation in the wild despite POC availability - consistent with a niche, low-footprint product; no CISA KEV listing.
AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Bdtask Wholesale Inventory Control and Inventory Management System up to version 20251013 allows high-privileged remote attackers to manipulate the first_name and last_name parameters in the /Admin_dashboard/edit_profile endpoint, leading to unauthorized database queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
SQL injection in Abdullah-Hasan-Sajjad's Online-School PHP application allows remote unauthenticated attackers to manipulate database queries through the Email parameter in the student login endpoint. All versions up to commit f09dda77b4c29aa083ff57f4b1eb991b98b68883 are affected, with a publicly available exploit report published via GitHub. The vendor was contacted prior to disclosure but did not respond, meaning no patch exists and the application remains unpatched.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the judge_id parameter in /edit_judge.php, with publicly available exploit code demonstrating the vulnerability. The low CVSS score (2.1) reflects limited confidentiality impact and required authentication, but the SQL injection itself is a high-severity vulnerability class that could enable data exfiltration or modification depending on database permissions and downstream query construction.
SQL injection in code-projects Online Event Judging System 1.0 via the crit_id parameter in /edit_criteria.php allows authenticated remote attackers to manipulate database queries with low confidentiality and integrity impact. Exploitation requires valid user authentication but can be executed remotely with no user interaction. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) indicates this vulnerability has minimal real-world exploitation probability despite public disclosure.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/remove-announcement.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. Publicly available exploit code exists, but EPSS exploitation probability is extremely low (0.01th percentile), suggesting the vulnerability requires authenticated access and offers minimal real-world payoff despite network accessibility.
SQL injection in SourceCodester Online Student Result System 1.0 exposes remote unauthenticated attackers a direct path to manipulate backend database queries via the unsanitized `id` parameter in `/view_result.php`. Successful exploitation can yield unauthorized access to student result records, partial data modification, and limited availability disruption. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% (8th percentile) signals negligible observed exploitation activity, consistent with the product's narrow educational/demo deployment footprint rather than any technical barrier to exploitation.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the contestant_id parameter in /edit_contestant.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a publicly available exploit and low EPSS score (0.03%), suggesting it poses minimal real-world risk despite public exploit availability.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_contestant.php, enabling database queries with limited data access. The vulnerability has low real-world risk despite public exploit availability, as it requires valid user authentication and produces only limited information disclosure (CVSS 2.1, EPSS 0.03%), though organizations running this application should apply fixes promptly to eliminate the attack vector entirely.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_judge.php, enabling limited data extraction with low confidentiality impact. The CVSS 2.1 score reflects the authentication requirement and bounded scope, but publicly available exploit code exists; however, the 0.03% EPSS percentile indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in AMTT Hotel Broadband Operation System (HiBOS) 1.0 exposes hotel network management infrastructure to unauthenticated remote attackers via the `uid` parameter in `/user/portal/get_expiredtime.php`. An attacker with network access to the management portal can manipulate the parameter to read, modify, or partially disrupt the underlying database without any credentials. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, and no patch has been released.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the content parameter in /ajax/action.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS scoring (0.03%) suggests minimal real-world exploitation despite public POC availability. The vulnerability requires prior authentication, significantly limiting practical attack surface.
SQL injection in CLTPHP 3.0 exposes the application's database to unauthenticated remote attackers via the `keyword` parameter in the `/home/search.html` search endpoint. The vulnerability stems from unsanitized user input being passed directly into SQL query construction, enabling data extraction and potential modification. A public proof-of-concept exploit has been disclosed (E:P in the CVSS 4.0 vector), though EPSS of 0.03% at the 7th percentile indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the ID parameter in clientdetails/welcome.php, enabling database queries with limited scope impact. CVSS 2.1 reflects low severity due to authentication requirement (PR:L) and limited confidentiality/integrity exposure (VC:L/VI:L), though publicly available exploit code exists and EPSS scoring (0.03%, 8th percentile) indicates minimal real-world exploitation likelihood despite public POC availability.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/check-attendance.php, resulting in limited confidentiality and integrity compromise. The vulnerability requires valid administrator credentials, has publicly available exploit code, but carries very low real-world risk with an EPSS score of 0.03% due to authentication requirements and limited impact scope (CVE4.0 vector shows only partial confidentiality/integrity loss, no availability impact).
SQL injection in code-projects Automated Voting System 1.0 allows authenticated remote attackers to manipulate the Username parameter in /admin/user.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid login credentials (PR:L) and has publicly available exploit code, though real-world exploitation risk is minimal given the CVSS 2.1 score and 0.03% EPSS percentile.
SQL injection in projectworlds Advanced Library Management System 1.0 exposes the application's database through the unsanitized `keywords` parameter on `/index.php`, exploitable by any unauthenticated remote attacker. The CVSS 4.0 score is 5.5 (Medium), with low-level confidentiality, integrity, and availability impact against the vulnerable system and no scope change to subsequent systems. A public proof-of-concept exploit exists (E:P in the provided vector), though EPSS sits at just 0.03% (9th percentile), consistent with the highly niche deployment footprint of this product; no public exploit identified at time of analysis for widespread campaigns.
SQL injection in SourceCodester Best House Rental Management System 1.0 allows high-privilege remote attackers to manipulate the house_no parameter in the save_house function of /admin_class.php, achieving limited confidentiality and integrity impact. Publicly available exploit code exists but exploitation requires administrative credentials (PR:H), significantly restricting real-world attack surface despite the CVSS 4.0 network vector.
SQL injection in projectworlds Online Shopping System 1.0 exposes database contents to unauthenticated remote attackers via the `keywords` parameter in `/login_submit.php`. The attack requires no credentials, no user interaction, and carries low access complexity, making it trivially scriptable against any exposed instance. Publicly available exploit code exists per a GitHub proof-of-concept, though the EPSS score of 0.03% (9th percentile) reflects the product's limited real-world deployment footprint; no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
SQL injection in SourceCodester Best House Rental Management System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in the login2 function of /admin_class.php, enabling authentication bypass or database enumeration. A public proof-of-concept exploit has been published on GitHub, confirming exploitability. No KEV listing and a low EPSS score (0.03%, 8th percentile) suggest exploitation remains opportunistic and low-volume, consistent with the niche deployment footprint of this PHP script.
SQL injection in the Charitable WordPress plugin versions up to 1.8.8.4 allows authenticated users with Subscriber-level access to extract sensitive database information via the donation_ids parameter due to insufficient escaping and lack of prepared statements. The vulnerability requires a paid donation to exploit and affects the donation query processing logic. No public exploit code or active exploitation has been confirmed at the time of analysis, though the flaw is straightforward to weaponize given the low attack complexity and documented vulnerable code path.
Unauthenticated SQL injection in Aksis Technology Netty ERP versions prior to V.1.1000 allows remote attackers to manipulate backend database queries with full confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is rooted in improper neutralization of special elements in SQL commands (CWE-89), and no public exploit has been identified at time of analysis, though the Turkish national CSIRT (USOM) has issued a public bulletin tracking this issue.
SQL injection in RapidResult WordPress plugin versions up to 1.2 allows authenticated attackers with contributor-level permissions to extract sensitive database information via insufficient escaping of the 's' parameter. The vulnerability affects all versions through 1.2 and requires valid WordPress account credentials, limiting exposure to sites where user registration is enabled or internal contributors exist.
SQL injection in the WooCommerce Advanced Coupons plugin (<= 4.6.8) allows authenticated attackers with administrator privileges to execute arbitrary SQL queries, potentially extracting sensitive data from the database. Exploitation requires high-level access rights, and no active exploitation or public exploit has been reported. EPSS score is very low (0.03%), indicating low probability of widespread exploitation.
SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands. Exploitation can exfiltrate sensitive database contents (C:H) and, to a limited degree, affect data availability (A:L). The vulnerability currently has no known public exploit, and EPSS predicts very low exploitation probability (0.04%).
Blind SQL injection in Crocoblock JetSearch plugin (WordPress) versions up to 3.5.10 allows unauthenticated remote attackers to extract database contents via crafted search queries. The vulnerability carries a critical CVSS 9.3 score due to network-based exploitation requiring no authentication or user interaction, though EPSS exploitation probability remains low at 0.04% (12th percentile), and no public exploit identified at time of analysis. The flaw enables data exfiltration from WordPress databases hosting sites using the vulnerable search plugin.
SQL injection in WordPress SMS Alert Order Notifications plugin through version 3.8.5 allows remote unauthenticated attackers to extract sensitive database contents via network-accessible injection points. The vulnerability achieves scope change with high confidentiality impact, enabling cross-boundary data exfiltration from the WordPress database. EPSS data unavailable; not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis, though the unauthenticated remote attack vector presents significant risk for WordPress installations using this plugin.
SQL injection in the Hydra Booking WordPress booking plugin (versions through 1.1.10) allows authenticated users with low privileges to extract sensitive data from the underlying database, with a scope-changed CVSS rating indicating the injection may reach beyond WordPress-specific tables to other databases accessible by the shared MySQL user. The vulnerability requires only a low-privilege account (PR:L) and no user interaction, making it exploitable by any registered WordPress user. No public exploit code or active exploitation has been identified; EPSS stands at 0.07% (21st percentile), suggesting low real-world exploitation activity at time of analysis.
SQL injection in the AnyComment WordPress commenting plugin (versions through 0.3.6) allows authenticated low-privilege users to extract data from the underlying WordPress MySQL database by sending crafted requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection can traverse beyond the plugin's own tables and reach the full WordPress database schema - including wp_users, wp_options, and other sensitive stores. No public exploit identified at time of analysis; EPSS at 0.03% (8th percentile) reflects very low current exploitation likelihood.
SQL injection in Email Tracker plugin for WordPress (versions up to 5.3.15) allows authenticated administrators to extract sensitive database information via the 'orderby' parameter due to insufficient escaping and query preparation. CVSS 4.9 reflects high confidentiality impact but requires high-privilege authenticated access; no public exploit code or active exploitation confirmed at analysis time.
SQL injection in Microchip TimeProvider 4100 Grandmaster (firmware <2.5) allows adjacent network attackers with low-level privileges to achieve high integrity and availability impact across system and vulnerable components. EPSS exploitation probability is low (0.03%, 9th percentile) with no public exploit identified at time of analysis. Authentication requirements indicate PR:L (low privileges required) per CVSS vector. Attack complexity is low but requires present attack timing conditions (AT:P).
SQL injection in Vvveb up to version 1.0.7.3 allows authenticated high-privileged remote attackers to execute arbitrary SQL queries through the Raw SQL Handler import function in admin/controller/tools/import.php. The vulnerability requires administrative credentials and has been publicly disclosed with exploit code available, though EPSS modeling indicates low real-world exploitation probability at 0.04%.
SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to manipulate the orderField parameter in the /DeviceState.do?Action=Query endpoint, potentially extracting or modifying database contents. The vulnerability requires valid credentials but carries minimal confidentiality and integrity impact per CVSS scoring. Public exploit code is available, though EPSS exploitation probability remains low at 0.03%, suggesting either limited technical feasibility, narrow applicability, or defensive measures in typical deployments.
SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to execute arbitrary SQL queries via the sortField parameter in the /DeviceFault.do?Action=Query endpoint. While the CVSS score is low (2.1) due to limited scope and confidentiality impact, publicly available exploit code exists and the vulnerability requires only low-privilege authentication. The vendor has not responded to early disclosure attempts, leaving no patch path available.
SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to execute arbitrary SQL queries via the orderField parameter in the /MemoryState.do?Action=Query endpoint, potentially exposing or modifying database contents. Publicly available exploit code exists, but the CVSS score of 2.1 reflects low confidentiality, integrity, and availability impact with no scope change. The vendor did not respond to early disclosure.
SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to manipulate the orderField parameter in the /RepairRecord.do?Action=QueryLast endpoint, enabling database query manipulation with limited confidentiality and integrity impact. Publicly available exploit code exists and the vendor has not responded to early disclosure notification. Despite a low CVSS score of 2.1, the combination of public exploit availability and vendor non-responsiveness increases real-world risk, though exploitation requires valid user credentials and produces only low-severity data exposure.
SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in the /cms/model/hasUse function. The vulnerability has low immediate impact (CVSS 2.1) but carries elevated real-world risk due to publicly available exploit code, authenticated but network-accessible attack vector, and vendor non-responsiveness to disclosure. Exploitation requires valid user credentials but no user interaction or special conditions.
SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to manipulate the cid parameter in the /cms/article/update endpoint, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires valid user authentication and has publicly available exploit code, but carries low real-world risk due to the CVSS 2.1 score and minimal EPSS probability (0.02%). The vendor has not responded to early disclosure notifications.
SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to manipulate the cid parameter in the /cms/article/findField endpoint, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires valid user authentication (PR:L in CVSS 4.0) and publicly available exploit code exists, but real-world exploitation risk remains low due to minimal data confidentiality/integrity impact (VC:L/VI:L) and only 0.02% EPSS exploitation probability, suggesting this is a low-priority SQL injection compared to unauthenticated or higher-impact variants.
PHP object injection in Vfront 0.99.52's mexcel.php endpoint exposes an unauthenticated POST parameter directly to unserialize() without class restrictions, enabling remote attackers to instantiate arbitrary PHP objects. Depending on exploitable gadget chains present in the Vfront codebase or its PHP dependencies, this can escalate to remote code execution, SQL injection, path traversal, or denial of service. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.40% (32nd percentile), consistent with the absence of a CISA KEV listing.
SQL injection in the TARIFFUXX WordPress plugin up to version 1.4 allows authenticated attackers with Contributor-level or higher privileges to inject malicious SQL commands via the 'id' attribute in the 'tariffuxx_configurator' shortcode, enabling unauthorized extraction of sensitive database information. The vulnerability exploits insufficient input sanitization in SQL query construction and requires authenticated access, resulting in a CVSS 6.5 (medium-high) rating with confirmed confidentiality impact but no availability or integrity compromise.
SQL Injection in onOffice for WP-Websites plugin (versions ≤6.5.1) allows authenticated attackers with Editor-level access or above to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'order' parameter. The vulnerability requires high privileges and user interaction is not needed, resulting in a CVSS score of 4.9 with confirmed confidentiality impact but no integrity or availability compromise.
SQL injection in itsourcecode Online Examination System 1.0 allows remote attackers to manipulate the Username parameter of /index.php to execute arbitrary SQL commands, compromising database confidentiality, integrity, and availability. Public exploit code exists, but the extremely low EPSS score (0.01%) indicates minimal real-world exploitation likelihood. No vendor patch is available.
Blind SQL injection in SFS Consulting's Winsure platform (all versions through the 21.08.2025 release) allows remote unauthenticated attackers to manipulate backend database queries via crafted input. The flaw carries a CVSS 9.8 rating reflecting network-reachable, low-complexity exploitation with no privileges or user interaction required, and no public exploit identified at time of analysis. The advisory was issued by Turkey's national CERT (USOM), suggesting regional relevance to Turkish insurance-sector deployments.
SQL injection in Cats Information Technology's Aykome License Tracking System (versions prior to the 06.10.2025 build) allows remote unauthenticated attackers to manipulate backend database queries via crafted input. The flaw carries a critical 9.8 CVSS score with full confidentiality, integrity, and availability impact, though EPSS rates near-term exploitation probability at only 0.04% and no public exploit identified at time of analysis. The vulnerability was disclosed by Turkey's national CERT (USOM) under advisory TR-25-0332.
SQL injection in Automated Voting System 1.0 allows high-privileged remote attackers to manipulate the Password parameter in /admin/update_user.php, potentially causing limited confidentiality and integrity impacts. The vulnerability requires admin-level privileges (PR:H) to exploit and has publicly available exploit code, but carries very low real-world risk due to EPSS of 0.01% and the high privilege requirement that limits practical attack surface.
SQL injection in Automated Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/add_candidate_modal.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a very low CVSS score (2.1) due to requirement for authenticated access and limited scope, but publicly available exploit code exists. Active exploitation is not confirmed in CISA KEV, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows high-privileged attackers to manipulate the searchdata parameter in /admin/search-appointment.php, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires administrative privileges to exploit and has a publicly disclosed proof-of-concept, though real-world exploitation risk is minimal given the EPSS score of 0.01% and the requirement for high-privilege access.
SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows authenticated high-privilege administrators to execute arbitrary SQL queries via the sername parameter in /admin/manage-services.php. The vulnerability requires high administrative privileges and has publicly available exploit code, though real-world impact is limited by its requirement for already-compromised admin accounts with no lateral movement or privilege escalation capability.
SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate the serv_id parameter in /booking.php, potentially gaining unauthorized access to the database or modifying data. A public exploit is available, though EPSS assigns a low exploitation probability (0.03%). No active exploitation is reported.
SQL injection in the Inferno Online Clothing Store PHP application's login endpoint (/log.php) exposes the cemail and password parameters to unsanitized database queries, enabling unauthenticated remote attackers to extract database contents or bypass authentication entirely. The affected codebase is tracked to commit 827dd42bfbe380e8de76fdc67958c24cf1246208 of the yousaf530 GitHub project. A public proof-of-concept exploit exists per VulDB submission 665475, and the vendor did not respond to responsible disclosure outreach.
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been found in itsourcecode Billing System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0.php?action=delete_course. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in CodeAstro Gym Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Gym Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in itsourcecode Online Loan Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in SourceCodester Best House Rental Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the user supplied. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Blind SQL injection in the MasterStudy LMS WordPress plugin by Stylemix through version 3.6.27 allows high-privileged authenticated users to extract database contents via crafted requests to vulnerable admin-side parameters. The CVSS 3.1 score of 7.6 reflects a scope change (S:C), meaning successful exploitation reaches the shared WordPress database layer and can expose data belonging to core WordPress tables and co-installed plugins - not only LMS-specific records. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at 0.03% (10th percentile) confirming very low observed exploitation probability at time of analysis.
Blind SQL injection in Abis Technology BAPSIS versions prior to 202510271606 allows unauthenticated remote attackers to manipulate backend database queries over the network with no user interaction. The CVSS 9.8 rating reflects full compromise of confidentiality, integrity, and availability, though EPSS remains very low at 0.04% (13th percentile) and no public exploit identified at time of analysis. Disclosure originates from Turkey's national CERT (USOM), suggesting regional product exposure rather than mass-market footprint.
Remote unauthenticated SQL injection in Ghost Hot Spot's login form allows direct database manipulation and potential authentication bypass for versions up to 20251014, confirmed by published POC code. The extremely low EPSS score (0.03%, 7th percentile) contradicts technical exploitability metrics, suggesting limited real-world threat from this niche product. Vendor non-response precludes a timely security patch.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the `/admin/admin_football.php` endpoint to database manipulation via the unsanitized `pid` parameter, achievable by remote unauthenticated attackers per the CVSS 4.0 PR:N rating. The flaw enables limited read, write, and availability impact against the backend database. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS remains extremely low at 0.03% (8th percentile), consistent with this product's negligible real-world deployment footprint and no CISA KEV listing.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the `/admin/admin_product.php` endpoint to remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. Publicly available exploit code exists (GitHub CVE issue #16), though the EPSS score of 0.01% at the 1st percentile signals negligible observed exploitation probability - consistent with a niche, low-footprint hobbyist application. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin panel endpoint /admin/admin_feature.php to database manipulation via the unsanitized `pid` parameter. The provided CVSS 4.0 vector asserts PR:N (no privileges required), though the /admin/ path suggests authentication may be in play - this discrepancy is noted and should be verified against the actual application. A publicly available proof-of-concept exploit exists on GitHub, though the EPSS score of 0.01% (1st percentile) indicates real-world exploitation attempts remain negligible, consistent with the product's obscure deployment footprint. No vendor-released patch has been identified at time of analysis.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter in /admin/admin_index.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and minimal skill, and a public proof-of-concept exists on GitHub. Despite this, real-world risk is curtailed by the product's extremely niche deployment footprint, an EPSS of just 0.01% (1st percentile), and absence from CISA KEV - making mass exploitation implausible.
SQL injection in shawon100 RUET OJ through the ID parameter of /details.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The vulnerability affects commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code released. Despite moderate CVSS 2.1, the low EPSS score of 0.02% and requirement for prior authentication significantly limit real-world exploitation likelihood.
SQL injection in RUET OJ via the Name parameter in /contestproblem.php allows authenticated remote attackers to execute arbitrary SQL queries with limited impact on confidentiality and integrity. The vulnerability affects the rolling-release codebase up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, requires valid login credentials to exploit, and carries a very low CVSS score (2.1) despite publicly available exploit code, indicating minimal real-world risk due to authentication barriers and constrained database access.
SQL injection in RUET OJ /description.php endpoint allows authenticated remote attackers to manipulate the ID parameter and inject arbitrary SQL commands, achieving limited confidentiality and integrity compromise. The vulnerability affects the rolling-release version up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code disclosed. Despite the public disclosure, the extremely low EPSS score (0.02%) and high authentication barrier suggest minimal real-world exploitation risk, though the unresponsive vendor posture leaves the codebase unpatched.
SQL injection in RUET OJ's /process.php POST request handler allows remote unauthenticated attackers to manipulate the 'un' parameter to interact with the underlying database. The affected codebase, maintained by shawon100 on GitHub, uses no formal versioning - all commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 are affected. A public exploit has been disclosed via VulDB, though the EPSS score of 0.02% (6th percentile) reflects the product's extremely limited deployment footprint; no active exploitation is confirmed.
SQL injection in SourceCodester Best Salon Management System 1.0 exposes unauthenticated remote attackers to database manipulation via the `email` parameter in the `/panel/forgot-password.php` password recovery endpoint. A public proof-of-concept exploit has been disclosed, though EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate very low observed real-world exploitation. Impact is partial across confidentiality, integrity, and availability per the CVSS 4.0 scoring, consistent with a restricted database account context rather than full system compromise.
SQL injection in code-projects Courier Management System 1.0 exposes the /courier/edit-courier.php endpoint to unauthenticated remote attackers who can manipulate the OfficeName parameter to execute arbitrary SQL against the backend database. A publicly available exploit exists on GitHub (PoC by Abxery), though the EPSS score of 0.03% at the 8th percentile reflects negligible observed exploitation activity. The vulnerability is not listed in CISA KEV, consistent with the product's extremely limited production deployment footprint.
SQL injection in code-projects Food Ordering System 1.0 allows high-privileged remote attackers to manipulate the itemPrice parameter in /admin/menu.php, leading to limited data exposure and modification. The vulnerability requires administrative authentication and has publicly available exploit code, but carries low real-world exploitation risk due to administrative privilege requirement and minimal technical impact (CVSS 2.0, EPSS 0.03%).
SQL injection in code-projects Food Ordering System 1.0 allows remote attackers with high-level administrative privileges to execute arbitrary SQL commands via the itemID parameter in /admin/deleteitem.php. Despite public exploit availability, real-world risk is minimal due to requirement for authenticated administrator access and low CVSS impact scope (CVSS 2.0, EPSS 0.03%). The vulnerability affects only the administrative interface and does not escalate privileges or compromise confidentiality at scale.
SQL injection in Nero Social Networking Site 1.0 exposes the /friendprofile.php endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter. The CVSS 4.0 score of 5.5 reflects low-level confidentiality, integrity, and availability impact with no scope change to downstream systems. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.03% (8th percentile) indicates negligible observed exploitation activity, consistent with the product's extremely narrow deployment footprint as a PHP demo application.
SQL injection in Nero Social Networking Site 1.0 exposes the `/deletemessage.php` endpoint to unauthenticated remote attackers who can manipulate the `message_id` parameter to execute arbitrary SQL commands against the backend database. The affected product is a PHP-based hobbyist/academic application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0). A public proof-of-concept exploit has been released on GitHub, though EPSS remains at 0.03% (8th percentile), indicating negligible observed exploitation activity consistent with the product's near-zero production deployment footprint.
SQL injection in the /addfriend.php endpoint of Nero Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL against the underlying database. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.03% (8th percentile) indicates negligible observed in-the-wild activity. The product is a PHP-based academic demo application from code-projects.org, substantially limiting real-world exposure despite the straightforward attack vector.
SQL injection in Nero Social Networking Site 1.0 exposes the `/acceptoffres.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 score of 5.5 reflects partial confidentiality, integrity, and availability impact against the vulnerable system only, with no scope change to subsequent systems. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate exploitation has not been observed at meaningful scale, likely due to the product's extremely limited deployment footprint.
SQL injection in SourceCodester Point of Sales 1.0 via the ID parameter in /delete_category.php allows high-privilege remote attackers to manipulate database queries. The vulnerability requires administrative credentials (PR:H) but carries low confidentiality, integrity, and availability impact. Public exploit code exists, though EPSS score (0.03%) suggests limited real-world exploitation despite public availability.
SQL injection in SourceCodester Point of Sales 1.0 (by janobe) via the Category parameter in /category.php allows remote, unauthenticated attackers to manipulate backend database queries with no user interaction required. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation is straightforward and requires no privileges, though impact is limited (VC:L/VI:L/VA:L), indicating partial data exposure and manipulation rather than full system compromise. A publicly available proof-of-concept exists - reflected in the E:P threat modifier - yet the very low EPSS score of 0.03% (8th percentile) and absence from CISA KEV indicate no public exploit identified at time of analysis has driven widespread automated attacks.
SQL injection in SourceCodester Point of Sales 1.0 exposes the login endpoint (/index.php) to unauthenticated remote exploitation via a malicious Username parameter, enabling database query manipulation. A public proof-of-concept exploit has been disclosed on GitHub (CVE/issues/2), confirming the attack is reproducible. EPSS sits at 0.03% (8th percentile), indicating limited observed exploitation in the wild despite POC availability - consistent with a niche, low-footprint product; no CISA KEV listing.
AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Bdtask Wholesale Inventory Control and Inventory Management System up to version 20251013 allows high-privileged remote attackers to manipulate the first_name and last_name parameters in the /Admin_dashboard/edit_profile endpoint, leading to unauthorized database queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
SQL injection in Abdullah-Hasan-Sajjad's Online-School PHP application allows remote unauthenticated attackers to manipulate database queries through the Email parameter in the student login endpoint. All versions up to commit f09dda77b4c29aa083ff57f4b1eb991b98b68883 are affected, with a publicly available exploit report published via GitHub. The vendor was contacted prior to disclosure but did not respond, meaning no patch exists and the application remains unpatched.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the judge_id parameter in /edit_judge.php, with publicly available exploit code demonstrating the vulnerability. The low CVSS score (2.1) reflects limited confidentiality impact and required authentication, but the SQL injection itself is a high-severity vulnerability class that could enable data exfiltration or modification depending on database permissions and downstream query construction.
SQL injection in code-projects Online Event Judging System 1.0 via the crit_id parameter in /edit_criteria.php allows authenticated remote attackers to manipulate database queries with low confidentiality and integrity impact. Exploitation requires valid user authentication but can be executed remotely with no user interaction. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) indicates this vulnerability has minimal real-world exploitation probability despite public disclosure.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/remove-announcement.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. Publicly available exploit code exists, but EPSS exploitation probability is extremely low (0.01th percentile), suggesting the vulnerability requires authenticated access and offers minimal real-world payoff despite network accessibility.
SQL injection in SourceCodester Online Student Result System 1.0 exposes remote unauthenticated attackers a direct path to manipulate backend database queries via the unsanitized `id` parameter in `/view_result.php`. Successful exploitation can yield unauthorized access to student result records, partial data modification, and limited availability disruption. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% (8th percentile) signals negligible observed exploitation activity, consistent with the product's narrow educational/demo deployment footprint rather than any technical barrier to exploitation.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the contestant_id parameter in /edit_contestant.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a publicly available exploit and low EPSS score (0.03%), suggesting it poses minimal real-world risk despite public exploit availability.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_contestant.php, enabling database queries with limited data access. The vulnerability has low real-world risk despite public exploit availability, as it requires valid user authentication and produces only limited information disclosure (CVSS 2.1, EPSS 0.03%), though organizations running this application should apply fixes promptly to eliminate the attack vector entirely.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_judge.php, enabling limited data extraction with low confidentiality impact. The CVSS 2.1 score reflects the authentication requirement and bounded scope, but publicly available exploit code exists; however, the 0.03% EPSS percentile indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in AMTT Hotel Broadband Operation System (HiBOS) 1.0 exposes hotel network management infrastructure to unauthenticated remote attackers via the `uid` parameter in `/user/portal/get_expiredtime.php`. An attacker with network access to the management portal can manipulate the parameter to read, modify, or partially disrupt the underlying database without any credentials. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, and no patch has been released.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the content parameter in /ajax/action.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS scoring (0.03%) suggests minimal real-world exploitation despite public POC availability. The vulnerability requires prior authentication, significantly limiting practical attack surface.
SQL injection in CLTPHP 3.0 exposes the application's database to unauthenticated remote attackers via the `keyword` parameter in the `/home/search.html` search endpoint. The vulnerability stems from unsanitized user input being passed directly into SQL query construction, enabling data extraction and potential modification. A public proof-of-concept exploit has been disclosed (E:P in the CVSS 4.0 vector), though EPSS of 0.03% at the 7th percentile indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the ID parameter in clientdetails/welcome.php, enabling database queries with limited scope impact. CVSS 2.1 reflects low severity due to authentication requirement (PR:L) and limited confidentiality/integrity exposure (VC:L/VI:L), though publicly available exploit code exists and EPSS scoring (0.03%, 8th percentile) indicates minimal real-world exploitation likelihood despite public POC availability.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/check-attendance.php, resulting in limited confidentiality and integrity compromise. The vulnerability requires valid administrator credentials, has publicly available exploit code, but carries very low real-world risk with an EPSS score of 0.03% due to authentication requirements and limited impact scope (CVE4.0 vector shows only partial confidentiality/integrity loss, no availability impact).
SQL injection in code-projects Automated Voting System 1.0 allows authenticated remote attackers to manipulate the Username parameter in /admin/user.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid login credentials (PR:L) and has publicly available exploit code, though real-world exploitation risk is minimal given the CVSS 2.1 score and 0.03% EPSS percentile.
SQL injection in projectworlds Advanced Library Management System 1.0 exposes the application's database through the unsanitized `keywords` parameter on `/index.php`, exploitable by any unauthenticated remote attacker. The CVSS 4.0 score is 5.5 (Medium), with low-level confidentiality, integrity, and availability impact against the vulnerable system and no scope change to subsequent systems. A public proof-of-concept exploit exists (E:P in the provided vector), though EPSS sits at just 0.03% (9th percentile), consistent with the highly niche deployment footprint of this product; no public exploit identified at time of analysis for widespread campaigns.
SQL injection in SourceCodester Best House Rental Management System 1.0 allows high-privilege remote attackers to manipulate the house_no parameter in the save_house function of /admin_class.php, achieving limited confidentiality and integrity impact. Publicly available exploit code exists but exploitation requires administrative credentials (PR:H), significantly restricting real-world attack surface despite the CVSS 4.0 network vector.
SQL injection in projectworlds Online Shopping System 1.0 exposes database contents to unauthenticated remote attackers via the `keywords` parameter in `/login_submit.php`. The attack requires no credentials, no user interaction, and carries low access complexity, making it trivially scriptable against any exposed instance. Publicly available exploit code exists per a GitHub proof-of-concept, though the EPSS score of 0.03% (9th percentile) reflects the product's limited real-world deployment footprint; no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
SQL injection in SourceCodester Best House Rental Management System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in the login2 function of /admin_class.php, enabling authentication bypass or database enumeration. A public proof-of-concept exploit has been published on GitHub, confirming exploitability. No KEV listing and a low EPSS score (0.03%, 8th percentile) suggest exploitation remains opportunistic and low-volume, consistent with the niche deployment footprint of this PHP script.
SQL injection in the Charitable WordPress plugin versions up to 1.8.8.4 allows authenticated users with Subscriber-level access to extract sensitive database information via the donation_ids parameter due to insufficient escaping and lack of prepared statements. The vulnerability requires a paid donation to exploit and affects the donation query processing logic. No public exploit code or active exploitation has been confirmed at the time of analysis, though the flaw is straightforward to weaponize given the low attack complexity and documented vulnerable code path.
Unauthenticated SQL injection in Aksis Technology Netty ERP versions prior to V.1.1000 allows remote attackers to manipulate backend database queries with full confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is rooted in improper neutralization of special elements in SQL commands (CWE-89), and no public exploit has been identified at time of analysis, though the Turkish national CSIRT (USOM) has issued a public bulletin tracking this issue.
SQL injection in RapidResult WordPress plugin versions up to 1.2 allows authenticated attackers with contributor-level permissions to extract sensitive database information via insufficient escaping of the 's' parameter. The vulnerability affects all versions through 1.2 and requires valid WordPress account credentials, limiting exposure to sites where user registration is enabled or internal contributors exist.
SQL injection in the WooCommerce Advanced Coupons plugin (<= 4.6.8) allows authenticated attackers with administrator privileges to execute arbitrary SQL queries, potentially extracting sensitive data from the database. Exploitation requires high-level access rights, and no active exploitation or public exploit has been reported. EPSS score is very low (0.03%), indicating low probability of widespread exploitation.
SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands. Exploitation can exfiltrate sensitive database contents (C:H) and, to a limited degree, affect data availability (A:L). The vulnerability currently has no known public exploit, and EPSS predicts very low exploitation probability (0.04%).
Blind SQL injection in Crocoblock JetSearch plugin (WordPress) versions up to 3.5.10 allows unauthenticated remote attackers to extract database contents via crafted search queries. The vulnerability carries a critical CVSS 9.3 score due to network-based exploitation requiring no authentication or user interaction, though EPSS exploitation probability remains low at 0.04% (12th percentile), and no public exploit identified at time of analysis. The flaw enables data exfiltration from WordPress databases hosting sites using the vulnerable search plugin.
SQL injection in WordPress SMS Alert Order Notifications plugin through version 3.8.5 allows remote unauthenticated attackers to extract sensitive database contents via network-accessible injection points. The vulnerability achieves scope change with high confidentiality impact, enabling cross-boundary data exfiltration from the WordPress database. EPSS data unavailable; not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis, though the unauthenticated remote attack vector presents significant risk for WordPress installations using this plugin.
SQL injection in the Hydra Booking WordPress booking plugin (versions through 1.1.10) allows authenticated users with low privileges to extract sensitive data from the underlying database, with a scope-changed CVSS rating indicating the injection may reach beyond WordPress-specific tables to other databases accessible by the shared MySQL user. The vulnerability requires only a low-privilege account (PR:L) and no user interaction, making it exploitable by any registered WordPress user. No public exploit code or active exploitation has been identified; EPSS stands at 0.07% (21st percentile), suggesting low real-world exploitation activity at time of analysis.
SQL injection in the AnyComment WordPress commenting plugin (versions through 0.3.6) allows authenticated low-privilege users to extract data from the underlying WordPress MySQL database by sending crafted requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection can traverse beyond the plugin's own tables and reach the full WordPress database schema - including wp_users, wp_options, and other sensitive stores. No public exploit identified at time of analysis; EPSS at 0.03% (8th percentile) reflects very low current exploitation likelihood.
SQL injection in Email Tracker plugin for WordPress (versions up to 5.3.15) allows authenticated administrators to extract sensitive database information via the 'orderby' parameter due to insufficient escaping and query preparation. CVSS 4.9 reflects high confidentiality impact but requires high-privilege authenticated access; no public exploit code or active exploitation confirmed at analysis time.
SQL injection in Microchip TimeProvider 4100 Grandmaster (firmware <2.5) allows adjacent network attackers with low-level privileges to achieve high integrity and availability impact across system and vulnerable components. EPSS exploitation probability is low (0.03%, 9th percentile) with no public exploit identified at time of analysis. Authentication requirements indicate PR:L (low privileges required) per CVSS vector. Attack complexity is low but requires present attack timing conditions (AT:P).
SQL injection in Vvveb up to version 1.0.7.3 allows authenticated high-privileged remote attackers to execute arbitrary SQL queries through the Raw SQL Handler import function in admin/controller/tools/import.php. The vulnerability requires administrative credentials and has been publicly disclosed with exploit code available, though EPSS modeling indicates low real-world exploitation probability at 0.04%.
SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to manipulate the orderField parameter in the /DeviceState.do?Action=Query endpoint, potentially extracting or modifying database contents. The vulnerability requires valid credentials but carries minimal confidentiality and integrity impact per CVSS scoring. Public exploit code is available, though EPSS exploitation probability remains low at 0.03%, suggesting either limited technical feasibility, narrow applicability, or defensive measures in typical deployments.
SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to execute arbitrary SQL queries via the sortField parameter in the /DeviceFault.do?Action=Query endpoint. While the CVSS score is low (2.1) due to limited scope and confidentiality impact, publicly available exploit code exists and the vulnerability requires only low-privilege authentication. The vendor has not responded to early disclosure attempts, leaving no patch path available.
SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to execute arbitrary SQL queries via the orderField parameter in the /MemoryState.do?Action=Query endpoint, potentially exposing or modifying database contents. Publicly available exploit code exists, but the CVSS score of 2.1 reflects low confidentiality, integrity, and availability impact with no scope change. The vendor did not respond to early disclosure.
SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to manipulate the orderField parameter in the /RepairRecord.do?Action=QueryLast endpoint, enabling database query manipulation with limited confidentiality and integrity impact. Publicly available exploit code exists and the vendor has not responded to early disclosure notification. Despite a low CVSS score of 2.1, the combination of public exploit availability and vendor non-responsiveness increases real-world risk, though exploitation requires valid user credentials and produces only low-severity data exposure.
SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in the /cms/model/hasUse function. The vulnerability has low immediate impact (CVSS 2.1) but carries elevated real-world risk due to publicly available exploit code, authenticated but network-accessible attack vector, and vendor non-responsiveness to disclosure. Exploitation requires valid user credentials but no user interaction or special conditions.
SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to manipulate the cid parameter in the /cms/article/update endpoint, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires valid user authentication and has publicly available exploit code, but carries low real-world risk due to the CVSS 2.1 score and minimal EPSS probability (0.02%). The vendor has not responded to early disclosure notifications.
SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to manipulate the cid parameter in the /cms/article/findField endpoint, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires valid user authentication (PR:L in CVSS 4.0) and publicly available exploit code exists, but real-world exploitation risk remains low due to minimal data confidentiality/integrity impact (VC:L/VI:L) and only 0.02% EPSS exploitation probability, suggesting this is a low-priority SQL injection compared to unauthenticated or higher-impact variants.
PHP object injection in Vfront 0.99.52's mexcel.php endpoint exposes an unauthenticated POST parameter directly to unserialize() without class restrictions, enabling remote attackers to instantiate arbitrary PHP objects. Depending on exploitable gadget chains present in the Vfront codebase or its PHP dependencies, this can escalate to remote code execution, SQL injection, path traversal, or denial of service. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.40% (32nd percentile), consistent with the absence of a CISA KEV listing.
SQL injection in the TARIFFUXX WordPress plugin up to version 1.4 allows authenticated attackers with Contributor-level or higher privileges to inject malicious SQL commands via the 'id' attribute in the 'tariffuxx_configurator' shortcode, enabling unauthorized extraction of sensitive database information. The vulnerability exploits insufficient input sanitization in SQL query construction and requires authenticated access, resulting in a CVSS 6.5 (medium-high) rating with confirmed confidentiality impact but no availability or integrity compromise.
SQL Injection in onOffice for WP-Websites plugin (versions ≤6.5.1) allows authenticated attackers with Editor-level access or above to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'order' parameter. The vulnerability requires high privileges and user interaction is not needed, resulting in a CVSS score of 4.9 with confirmed confidentiality impact but no integrity or availability compromise.
SQL injection in itsourcecode Online Examination System 1.0 allows remote attackers to manipulate the Username parameter of /index.php to execute arbitrary SQL commands, compromising database confidentiality, integrity, and availability. Public exploit code exists, but the extremely low EPSS score (0.01%) indicates minimal real-world exploitation likelihood. No vendor patch is available.
Blind SQL injection in SFS Consulting's Winsure platform (all versions through the 21.08.2025 release) allows remote unauthenticated attackers to manipulate backend database queries via crafted input. The flaw carries a CVSS 9.8 rating reflecting network-reachable, low-complexity exploitation with no privileges or user interaction required, and no public exploit identified at time of analysis. The advisory was issued by Turkey's national CERT (USOM), suggesting regional relevance to Turkish insurance-sector deployments.
SQL injection in Cats Information Technology's Aykome License Tracking System (versions prior to the 06.10.2025 build) allows remote unauthenticated attackers to manipulate backend database queries via crafted input. The flaw carries a critical 9.8 CVSS score with full confidentiality, integrity, and availability impact, though EPSS rates near-term exploitation probability at only 0.04% and no public exploit identified at time of analysis. The vulnerability was disclosed by Turkey's national CERT (USOM) under advisory TR-25-0332.
SQL injection in Automated Voting System 1.0 allows high-privileged remote attackers to manipulate the Password parameter in /admin/update_user.php, potentially causing limited confidentiality and integrity impacts. The vulnerability requires admin-level privileges (PR:H) to exploit and has publicly available exploit code, but carries very low real-world risk due to EPSS of 0.01% and the high privilege requirement that limits practical attack surface.
SQL injection in Automated Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/add_candidate_modal.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a very low CVSS score (2.1) due to requirement for authenticated access and limited scope, but publicly available exploit code exists. Active exploitation is not confirmed in CISA KEV, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows high-privileged attackers to manipulate the searchdata parameter in /admin/search-appointment.php, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires administrative privileges to exploit and has a publicly disclosed proof-of-concept, though real-world exploitation risk is minimal given the EPSS score of 0.01% and the requirement for high-privilege access.
SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows authenticated high-privilege administrators to execute arbitrary SQL queries via the sername parameter in /admin/manage-services.php. The vulnerability requires high administrative privileges and has publicly available exploit code, though real-world impact is limited by its requirement for already-compromised admin accounts with no lateral movement or privilege escalation capability.
SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate the serv_id parameter in /booking.php, potentially gaining unauthorized access to the database or modifying data. A public exploit is available, though EPSS assigns a low exploitation probability (0.03%). No active exploitation is reported.
SQL injection in the Inferno Online Clothing Store PHP application's login endpoint (/log.php) exposes the cemail and password parameters to unsanitized database queries, enabling unauthenticated remote attackers to extract database contents or bypass authentication entirely. The affected codebase is tracked to commit 827dd42bfbe380e8de76fdc67958c24cf1246208 of the yousaf530 GitHub project. A public proof-of-concept exploit exists per VulDB submission 665475, and the vendor did not respond to responsible disclosure outreach.