SQL Injection

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.92.0. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.8%.

Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

openSIS through 7.4 allows SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue was discovered in rConfig through 3.9.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An issue was discovered in EyesOfNetwork 5.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 41.1%.

SQL injection vulnerability in Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.5%.

SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.

A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.5%.

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.2%.

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.1%.

SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.

SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.6%.

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.0%.

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 71.2%.

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.6%.

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.9%.

Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 29.4%.

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.5%.

Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.3%.

SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.5%.

inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.0%.

SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 56.3%.

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.

The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.5%.

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.3%.

Multiple input-validation and injection weaknesses in Cacti, the open-source network/operational monitoring and fault-management framework, are remediated in version 1.2.31 (Alpine package 1.2.31-0). The Alpine advisory and NVD classify the issue as SQL injection (CWE-89, CVSS 9.8), but the referenced upstream commit is a security rollup that fixes command injection in the data-input handler, CSV/formula injection in host and device exports, and a path-traversal in the external-links iframe loader. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

SQL injection in Cacti, the open-source network monitoring and graphing platform, lets an authenticated low-privilege user inject crafted database queries (CWE-89), yielding full confidentiality, integrity, and availability impact; it is fixed in version 1.2.31 (Alpine package 1.2.31-0). The flaw is reachable over the network without user interaction, but EPSS is low (0.19%, 8th percentile), there is no public exploit identified at time of analysis, and it is not on CISA KEV. Upstream advisory GHSA-pf37-v86f-5xwp and the consolidated fix commit address this alongside several related hardening fixes.

SQL injection (CWE-89) in the Cacti network monitoring platform allows an authenticated, high-privileged user to inject crafted SQL that compromises confidentiality, integrity, and availability of the backend database, as tracked by Alpine Linux and fixed in package version 1.2.31-0. The flaw was disclosed via Cacti's GitHub security advisory GHSA-j9jv-6xjq-9hhj and remediated in upstream Cacti release 1.2.31. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

SQL injection (CWE-89) in the Cacti open-source network monitoring platform is resolved in version 1.2.31, distributed by Alpine Linux as cacti 1.2.31-0 and tracked upstream in Cacti PR #7039 and advisory GHSA-69gg-mjfm-jjpc. The assigned CVSS 3.1 vector (9.8, AV:N/AC:L/PR:N/UI:N) describes a network-reachable, no-interaction database injection, though Cacti's console pages historically require an authenticated session, so the PR:N rating should be verified against the GHSA advisory. There is no public exploit identified at time of analysis and no CISA KEV or EPSS data was supplied, so active-exploitation risk cannot be confirmed from the available inputs.

SQL injection in Cacti's graph filtering logic (fixed in 1.2.31) lets remote attackers inject arbitrary SQL through the 'rfilter' request parameter, which was concatenated directly into RLIKE clauses without escaping. The flaw affects the aggregate graph and graph-tree views (aggregate_graphs.php, lib/html_tree.php) and additionally the sortable column/direction parameters, enabling extraction or manipulation of monitoring database contents. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but a vendor patch and security advisory (GHSA-9jqv-4cpm-vm2c) confirm the issue.

SQL injection in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector lets a remote attacker who already holds valid administrative credentials inject SQL statements through insufficiently validated parameters and read information from the monitoring database. The vulnerability affects ISE and ISE-PIC releases 3.1.x through 3.5.x and carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), meaning the impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the dominant limiting factor is the high-privilege prerequisite, so realistic exposure is confined to insiders, stolen-credential scenarios, or post-compromise abuse by an already-privileged actor.

Authenticated administrative users of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) can exploit insufficient input validation in affected APIs to perform SQL/HQL injection, enabling them to view or modify unauthorized database data, with a high integrity impact and low confidentiality impact. The vulnerability affects ISE/ISE-PIC versions 3.1 through 3.5 and requires valid administrative credentials; no public exploit identified at time of analysis.

Authenticated remote attackers holding valid administrative credentials can read sensitive data - including hashed credentials usable in follow-on attacks - from Cisco Identity Services Engine (ISE) by sending a single crafted API request that is improperly validated and reaches the backend as SQL (CWE-89). The flaw affects ISE Software across the 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5 branches at numerous patch levels; exploitation requires administrator-level privileges (PR:H) but no user interaction, and the API is network-reachable. Cisco's own CVSS of 4.9 (Medium) is a credible ceiling rather than an understatement, because the high-privilege prerequisite sharply limits who can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis.

SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, remote user with valid administrative credentials to submit crafted requests to affected APIs and run arbitrary SQL or HQL statements against the product's underlying database, giving them the ability to read or alter data they are not authorized to access. The vulnerability is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N per independent assessment), with the high privilege requirement (PR:H) and the low confidentiality but high integrity impact being the defining characteristics; the affected code spans the 3.1, 3.2, 3.3, 3.4 and 3.5 release trains. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the primary risk is insider or post-compromise abuse of administrative access rather than opportunistic external exploitation.

SQL injection in the REST APIs of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) allows an attacker who already holds valid administrative credentials to read information from the session database, with no integrity or availability impact. The vector is network-reachable, low complexity, and requires no user interaction, but the PR:H prerequisite confines this to a post-authentication data-disclosure/escalation concern rather than an initial-access vector. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; given the administrative credential requirement and read-only impact, this is a lower-priority issue despite the criticality of the affected product.

SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argument in /module/leave/index.php and potentially read or modify database contents. Publicly available exploit code exists, but the attack requires a valid session and the product is a niche PHP application unlikely to be internet-exposed in production, so our assessment treats this as a low-real-priority issue despite the genuine CWE-89 flaw. No CISA KEV confirmation is provided.

SQL injection in the login handler of SourceCodester Inventory and Monitoring System 1.0 lets remote unauthenticated attackers inject arbitrary SQL through the Username argument of /index.php, potentially reading and altering database contents. The flaw requires no credentials, no user interaction, and no non-default configuration, and publicly available exploit code exists; there is no indication of confirmed active exploitation (no CISA KEV listing). Note the scoring split: the CNA's CVSS 4.0 vector rates 5.5 with limited (VC:L/VI:L/VA:L) impact, while our independent assessment treats confidentiality and integrity as High (CVSS 3.1 9.8); real-world risk is in practice bounded less by any technical prerequisite than by the product's small deployment footprint.

SQL injection in SourceCodester Inventory and Monitoring System 1.0 allows remote attackers to manipulate database queries through the difficulty_id parameter of the /admins/assessments/databank/btn_functions.php?action=add endpoint. Publicly available exploit code exists, and the vendor-supplied CVSS 4.0 score of 6.9 treats the flaw as remotely reachable without authentication (PR:N); however, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N because the /admins/ path implies an administrative function that typically sits behind a login, so a valid staff or admin session may be required, which materially lowers realistic risk. Impact is limited to low-confidentiality and low-integrity effects on the backend database; there is no evidence of active exploitation, and the affected product is a niche PHP application with a very small deployment footprint, making broad opportunistic targeting unlikely.

SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.

Authenticated blind SQL injection in ScadaLTS 2.8.1-release-candidate build 0 lets any logged-in user with the lowest privilege tier (ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC) extract arbitrary database contents, including password hashes for every account on the platform. The flaw lives in the JSON sortBy array accepted by POST /api/events/search, whose values are concatenated straight into the SQL ORDER BY clause with no sanitization or parameterization, forcing attackers to use slower time-based and boolean-based inference rather than in-band extraction. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is well calibrated: exploitation requires valid credentials but scada-lts deployments that grant ROLE_PUBLIC or self-service low-privilege accounts effectively erase that barrier, and there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis.

SQL injection in code-projects Matrimonial System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL through the /search.php endpoint of the Regular Search component by manipulating any of the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters. The vendor-scored CVSS 4.0 base of 6.9 reflects limited per-dimension impact, but our independent assessment rates it more severely on confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), since a successful injection can expose the full contents of the backend database with no credentials, user interaction, or non-default configuration required. Publicly available exploit code exists (a GitHub proof-of-concept repository targeting the sex and mothertongue parameters), but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS data was provided. The practical risk is tempered by the application's likely negligible production footprint as a tutorial-grade PHP project.

SQL injection in the ID parameter of /module/employee/index.php in itsourcecode Leave Management System 1.0 allows an attacker holding a low-privilege authenticated session to read sensitive records and partially modify database contents, with no user interaction and no special configuration required. Publicly available exploit code exists, disclosed through a public GitHub issue and catalogued by VulDB, but there is no CISA KEV listing and therefore no confirmation of active exploitation. Our independent re-assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) treats the confidentiality impact as High and rates the issue more seriously than the CVSS 4.0 base score of 2.1 attached to the VulDB entry, although the practical risk is constrained by the product's extremely small real-world deployment footprint.

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks.

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.

Blind SQL injection in the WP Directory Kit WordPress plugin, affecting all versions up to and including 1.5.4, lets an authenticated attacker with 'custom-level access and above' append arbitrary SQL to an existing query through the unescaped 'order_by' parameter and extract sensitive data from the site's database. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) because exploitation is network-reachable and low-complexity but gated behind a valid low-privilege account; confidentiality is the only impacted pillar, as the injection is blind and does not permit direct read-out or data modification. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated on sites that expose low-privilege accounts and run a vulnerable plugin version.

SQL injection in the gedelumbung HospitalManagement application (PHP/CodeIgniter-style MVC codebase) allows an attacker who can reach the patient-index search function to inject arbitrary SQL through the 'cari' argument passed to generate_index_pasien in application/models/app_global_admin_model.php. The flaw is CWE-89, reachable over the network (AV:N, AC:L), but the CVSS 4.0 vector assigns PR:H, indicating exploitation in the intended path requires high-level (administrative) privileges; impact is limited to low confidentiality, integrity and availability (VC:L/VI:L/VA:L). Publicly available exploit code exists, but there is no CISA KEV listing and no confirmed active exploitation; the project uses rolling releases, so no fixed version is identified and the maintainer has not responded to the issue report.

Boolean-based SQL injection in Netmaker's SQLite database backend (versions prior to 1.5.0) lets an authenticated attacker manipulate the SQL executed by the `sqliteDeleteRecord` function through the `{domain}` path parameter of the `DELETE /api/dns/{network}/{domain}` endpoint. By crafting injected conditions that evaluate true or false, the attacker can infer the existence and contents of arbitrary database tables, columns, and values, resulting in limited confidentiality exposure. The flaw is rated CVSS 5.3 and requires a valid authenticated session and a SQLite-backed deployment; PostgreSQL-backed installations use parameterized queries and are not affected. Netmaker 1.5.0 patches the issue by replacing string concatenation with parameterized SQL. No exploitation in the wild or public exploit code has been identified at time of analysis.

Unauthenticated SQL injection in WuzhiCMS 4.0 and 4.1.0 allows remote attackers to tamper with backend database queries through the article::getDataOfJson action, because the title and master_table parameters are passed into SQL statements without sanitization. Publicly available exploit code exists (referenced via the vendor's own GitHub issue tracker), and the upstream project has not responded or issued a fix at the time of analysis. The CVSS v4.0 score of 6.9 with an E:P threat metric reflects confirmed proof-of-concept availability rather than an abstract theoretical risk.

Unauthenticated remote SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows an attacker to inject arbitrary SQL through the ID argument of /delete_faculty1.php, exposing or destroying records in the underlying database. The CVSS 4.0 vector rates network-reachable, low-complexity, no-privilege, no-interaction exploitation with low confidentiality, integrity and availability impact (base 5.5), and publicly available exploit code exists, so unpatched internet-facing instances are immediately at risk. No CISA KEV entry or EPSS score was supplied, so there is no confirmed evidence of active exploitation in the wild at time of analysis.

SQL injection in the WP Directory Kit WordPress plugin (versions through 1.5.7) lets authenticated users with page-builder access (Editor role and above) inject arbitrary SQL through widget settings that are stored without sanitization or escaping and then concatenated into a database query. The injected statement executes when the affected page is rendered, allowing the attacker to read arbitrary data from the WordPress database. Publicly available exploit code exists (WPScan advisory) and the vendor CPE is still listed as 'unknown', but there is no CISA KEV entry and EPSS is only 0.16%, indicating targeted rather than opportunistic mass exploitation.

SQL injection in zyx0814 FilePress up to version 3.0.1 allows remote unauthenticated attackers to manipulate database queries via the orderby and order parameters in dzz/publish/search.php. The Publish Module's search endpoint accepts unsanitized user-controlled sorting parameters directly into a SQL ORDER BY clause, enabling blind or time-based data extraction. A publicly available proof-of-concept exploit exists; the vendor has not responded to the coordinated disclosure report as of the time of analysis.

A SQL injection in SourceCodester Online Faculty Clearance System 1.0 lets remote attackers manipulate the 'haydi' argument handled by /update_requirement_status.php to inject arbitrary SQL into backend queries. The CVSS 4.0 vector reports AV:N/AC:L/PR:N/UI:N, so exploitation does not require prior authentication or user interaction, and the impact is scored as Low across confidentiality, integrity and availability. Publicly available exploit code exists (referenced via a public GitHub issue and the VULDB submission), and the vendor has published no patch - the product is a downloadable PHP demo application rather than a maintained commercial platform.

Unauthenticated SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows remote attackers to inject arbitrary SQL through the ID argument of /delete_requirement.php, giving them read and write access to the application's clearance records. Publicly available exploit code exists (GitHub OnlyCMJB/cve issue 2), and the flaw is tracked by VulDB and ENISA EUVD, but CISA KEV does not list it as actively exploited. Because this is a demo-grade PHP application distributed as downloadable source with no vendor patch channel identified, exposure is concentrated among institutions that deployed it as-is on an internet-facing web server.

SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.