SQL Injection

SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.

Unauthenticated SQL injection in the login handler (/College/login.php) of SourceCodester College Notes Gallery Management System 1.0 allows remote attackers to inject arbitrary SQL through the 'User' parameter. Publicly available exploit code exists (disclosed via a GitHub issue referenced by VulDB), and successful abuse can bypass authentication and expose or corrupt the backend database. The CVSS 4.0 base score is 5.5 with the E:P threat metric, reflecting limited but real confidentiality, integrity, and availability impact.

SQL injection in PHPGurukul Daily Expense Tracker System 1.1 exposes the unauthenticated forgot-password endpoint `/dets/forgot-password.php`, where the `email` and `contactno` parameters are passed unsanitized to backend SQL queries. Any remote, unauthenticated attacker can exploit this to read or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation; no KEV listing exists at time of analysis.

SQL injection in PHPGurukul Blood Donor Management System 1.0 lets remote attackers inject arbitrary SQL through the fromdate and todate parameters handled by /application/controllers/admin/Report.php, exposing or altering the underlying donor database. Publicly available exploit code exists and the vendor has published no fixed release, so any internet- or intranet-exposed deployment of this teaching/demo application remains vulnerable. CVSS 4.0 base is 5.5 with an exploit-maturity rating of Proof-of-Concept, indicating limited but real opportunistic risk rather than mass exploitation.

SQL injection in PHPGurukul Daily Expense Tracker System 1.1 allows unauthenticated remote attackers to manipulate the email parameter in the pre-authentication login form at /dets/index.php, enabling authentication bypass or database content extraction. A public exploit is available on GitHub, removing any meaningful skill barrier to exploitation. No vendor-released patch has been identified; the CVSS 4.0 score of 5.5 with all impacts rated Low reflects the application's narrow data scope rather than a general downgrade of the SQL injection risk class.

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures.

SQL injection in the doctor login page (doctorlogin.php) of the subhajitkhan online-clinic-management-system allows remote unauthenticated attackers to manipulate the doc_mail and doc_pswd parameters and execute arbitrary SQL against the backend database, potentially bypassing authentication or exfiltrating patient and staff records. Publicly available exploit code exists, and the project maintainer has not responded to the issue report; no patched version is available as the product uses a rolling release model.

SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID' argument of /module/company/index.php to run attacker-controlled SQL against the application's database. The flaw is a classic CWE-89 injection reachable over the network with no user interaction, but it requires an existing account on the application (CVSS 4.0 PR:L; assessed CVSS 3.1 PR:L), which is the main barrier to abuse. Publicly available exploit code exists (a proof-of-concept is linked from the VulDB submission and a GitHub issue), so the practical barrier is low for anyone who already holds credentials; however, EPSS is only 0.25% (16th percentile) and there is no CISA KEV listing, so signals converge on LOW real-world priority despite the injection class.

Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_email argument of /login.php to alter the authentication query and read or subvert backend data. Exploit code has been made publicly available (reflected as exploit maturity E:P in the CVSS 4.0 vector and referenced from a GitHub issue), so any internet-reachable deployment should be treated as immediately attackable. The flaw is not listed in CISA KEV and no EPSS score was supplied, so active in-the-wild exploitation is not confirmed — but the low attack complexity and zero authentication requirement make opportunistic scanning likely.

SQL injection in Yot CMS 3.3.x via the Login function in global.php allows remote unauthenticated attackers to supply crafted SQL payloads through the yot3_user and yot3_pass cookie values, bypassing authentication and forging administrator sessions. The researcher-published GitHub PoC (by dddwmr) explicitly demonstrates full admin session forgery as the end result, making the assigned CVSS 5.5 score a material understatement of actual impact. Publicly available exploit code exists; no CISA KEV listing was confirmed at time of analysis.

SQL injection in the `searchtext` parameter of `listdoctor.php` in subhajitkhan's online-clinic-management-system exposes the backend database to unauthenticated remote attackers. The flaw allows direct manipulation of SQL queries, potentially enabling full database enumeration and data modification. A public proof-of-concept exists via GitHub issue, the maintainer has not responded to disclosure, and no patch has been released for this rolling-release project.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the unsanitized prodcode parameter in /pages/pro_edit1.php. A public proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any attacker holding a low-privilege account. The CVSS 4.0 score of 2.1 reflects constrained partial database read, write, and availability impact rather than full compromise, and no active exploitation has been reported.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the `ID` parameter in `/pages/inv_edit1.php` to execute arbitrary SQL against the backend database. A public exploit has been disclosed via GitHub, lowering the skill barrier for opportunistic abuse. No vendor-released patch has been identified at time of analysis; the CVSS 4.0 score of 5.3 with E:P maturity reflects partial but confirmed exploitability.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter, enabling a low-privileged remote attacker to read or modify arbitrary backend database contents. A publicly available exploit (POC on GitHub) confirms the technique is reproducible with minimal skill. The vulnerability is no public exploit identified in CISA KEV, but the combination of network accessibility, a published POC, and trivial exploitation mechanics elevates practical risk for any instance exposed to the network.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the `firstname` parameter in `/pages/emp_transac.php?action=add`. A publicly available proof-of-concept exploit has been released via GitHub, confirming the attack path. The vulnerability arises from unsanitized user input being passed directly to a SQL query in a PHP-based web application, enabling data extraction or database manipulation depending on database permissions.

SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `firstname` parameter in `/pages/cust_pos_trans.php`. The flaw is a classic CWE-89 unsanitized input issue in a PHP-based point-of-sale and inventory management application. A publicly available proof-of-concept exploit exists; no public exploit identified as actively exploited in the wild (not in CISA KEV).

SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path.

SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Status parameter in /bilal/normal/save_stud.php. The vulnerability enables unauthorized data access, modification, and potential full database compromise through crafted HTTP requests. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising immediate exploitation risk for any exposed instances.

SQL injection in SourceCodester School Registration and Fee System 1.0 exposes the student deletion endpoint (/bilal/normal/delete_stud.php) to remote unauthenticated attackers through an unsanitized PHP array parameter `selector[]`. A proof-of-concept exploit is publicly available via GitHub, enabling attackers to read or manipulate the underlying MySQL/MariaDB database. The CVSS 4.0 score of 6.9 (Medium) reflects per-axis Low impact across confidentiality, integrity, and availability, consistent with a PHP application database rather than a critical infrastructure system; no KEV listing indicates no confirmed mass exploitation at time of analysis.

SQL injection in GongShengyue OnlineBooks allows authenticated remote attackers to manipulate database queries through the `column` parameter of the listSplit interface in BooksServlet.java. The vulnerability enables partial data extraction, modification, and potential availability impact against the backend database. A public proof-of-concept exploit has been published on GitHub, raising near-term exploitation probability for any internet-exposed deployments.

Authenticated SQL injection in Feng Office's reorder handler functions exposes the backend database to partial read and write access by privileged users. The vulnerability exists in `update_system_module_order` and `update_dimension_order` within `MoreController.class.php`, where the `modules` and `dims` arguments are interpolated into SQL queries without sanitization. All versions up to 3.11.13.11 are affected, a public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no patch available.

Unauthenticated SQL injection in Feng Office's Legacy API allows remote attackers to manipulate the `auth` argument passed to the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php, enabling partial read, write, and availability impact against the underlying database on versions up to and including 3.11.13.11. Publicly available exploit code has been disclosed on Google Drive, and the vendor did not respond to responsible disclosure contact prior to publication. No KEV listing exists, but the combination of PR:N attack surface and a live POC elevates practical risk above the moderate CVSS 4.0 score of 6.9.

SQL injection in LuxSoft LuxCal through version 5.3.4L allows unauthenticated remote attackers to extract data from the underlying database by sending crafted requests to two public-facing PHP endpoints: rssfeed.php and common/retrieve.php. The vulnerability is reachable without authentication, as RSS and data-retrieval endpoints are typically exposed to anonymous visitors. A researcher has published proof-of-concept details, making exploitation straightforward for any attacker with network access to a LuxCal instance. No public exploit identified at time of analysis beyond the researcher disclosure.

Authenticated SQL injection in the Smart Marketing SMS and Newsletters Forms WordPress plugin (versions ≤5.1.24) allows subscriber-level users to append arbitrary SQL to existing database queries, extracting sensitive data from the WordPress database. The vulnerability resides in insufficient input escaping on a user-supplied parameter before it reaches an existing SQL query, requiring only a low-privilege account and the plugin's sync/mapping feature to be in its typical operational state. No public exploit or active exploitation has been identified; the fix is available via WordPress SVN changeset 3663923.

SQL injection in the MPG - Multiple Page Generator WordPress plugin (all versions through 4.2.1) allows authenticated attackers holding only subscriber-level accounts to append arbitrary SQL into existing database queries via a crafted URL path, enabling full exfiltration of the WordPress database including password hashes, user PII, and stored credentials. The flaw originates in SpintaxController.php and Helper.php where URL-path parameters are interpolated into queries without adequate escaping or use of WordPress's prepare() API; the code path is only reachable when the [mpg_spintax] shortcode is rendered in site-wide components such as footers or template parts. No public exploit code has been identified at time of analysis, and an upstream fix has been committed to the WordPress plugin SVN repository (changeset 3687328) as reported by Wordfence.

Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.

SQL injection in the JasperReports reporting engine of OpenNMS Meridian and Horizon allows any authenticated ROLE_USER to execute arbitrary SQL against the OpenNMS PostgreSQL database by supplying a crafted DATE_FORMAT parameter to two default-enabled asset-management reports via the REST API. The database exposure includes SNMP community strings, provisioning credentials, and notification credentials for every monitored device - high-value intelligence enabling lateral movement across the managed network. No public exploit is identified at time of analysis, but the upstream patch diff on GitHub PR #8832 publicly names the vulnerable parameters and report IDs, substantially lowering the bar for exploit development.

SQL injection in Rizwan17's inventory-management-system allows unauthenticated remote attackers to manipulate database queries via the `pro_name[]` array parameter in the `storeCustomerOrderInvoice` function of `includes/manage.php`. The CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms no authentication is required and exploitation is straightforward. A public proof-of-concept exists via GitHub issue #13, and the vendor has not responded to the disclosure, leaving no patch available.

SQL injection in Rizwan17's inventory-management-system PHP application exposes the update_record() function in includes/manage.php to unauthenticated remote exploitation via unsanitized parameters (update_category, cid, update_brand, update_product). Exploit code is publicly available per the CVSS 4.0 E:P modifier and a VulDB submission, though the project is a small hobby-tier GitHub application with negligible production footprint. The maintainer was notified via a GitHub issue but has not responded, and no patch exists.

SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote attacker holding low-privilege credentials to execute unauthorized SQL commands against the product's backend database. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected, with confirmed limited confidentiality and integrity impact but no availability consequence. No active exploitation or public proof-of-concept has been identified at time of analysis; Dell has released patched versions under advisory DSA-2026-382.

SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote low-privileged attacker to extract sensitive data and potentially inject scripts into the application. Affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00), the flaw requires only valid low-privilege credentials and standard network access with no user interaction. Dell has released patched versions and no public exploit code has been identified at time of analysis.

Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.

Authenticated SQL injection in the Quentn WP WordPress plugin before 1.2.15 allows high-privilege users (administrators) to execute arbitrary SQL queries against the underlying database via an unsanitized parameter. Although the attack vector is network-accessible and no authentication bypass is needed, exploitation is constrained to administrators, significantly limiting real-world risk. A publicly available exploit code exists via WPScan, though EPSS remains very low at 0.16% (5th percentile), indicating no widespread opportunistic exploitation at time of analysis.

Second-order SQL injection in the WP Crowdfunding WordPress plugin by Themeum (versions ≤2.2.1) enables authenticated shop managers to exfiltrate arbitrary database contents. The attack is split across two phases: the attacker writes a malicious payload once to the `wpneo_reward` post meta via the WooCommerce REST API, and the unsanitized value is then injected into a live SQL query on every subsequent public page view that renders the campaign rewards sidebar - making the extraction persistent and silent. No public exploit or KEV listing is identified at time of analysis, but the high confidentiality impact (C:H) and persistent execution model elevate practical risk beyond the CVSS 4.9 base score.

SQL injection in the Mail Mint WordPress email marketing plugin (versions up to and including 1.31.0) allows authenticated attackers holding administrator-level access to extract sensitive records from the WordPress database via the REST API 'status' parameter. The root cause is a well-known $wpdb->prepare() misuse: the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() is called, so prepare()'s placeholder sanitization never processes the injected content. REST API bodies parsed from php://input further bypass WordPress's automatic wp_magic_quotes() escaping, allowing raw double-quote characters to reach the SQL sink unescaped. No public exploit has been identified and the vulnerability is not listed in CISA KEV.

SQL injection in PbootCMS versions 3.2.0 through 3.2.5 lets any authenticated backend user inject crafted parameters into the User/mod interface to rewrite arbitrary fields — including password hashes and role assignments — of other accounts, resulting in full account takeover. The flaw requires only a low-privileged login (CVSS PR:L) and no victim interaction, so a single compromised or low-privilege account can be escalated into administrative control of the CMS. Exploitation is easy (AC:L) but real-world urgency is tempered: no CISA KEV listing, an EPSS score of just 0.32% (25th percentile), and a public GitHub repository tied to the CVE identifier that suggests exploit code may be circulating.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_edit.php, enabling arbitrary SQL query execution against the underlying database. The affected product is a PHP-based open-source educational web application distributed via itsourcecode.com. Publicly available exploit code exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been recorded, consistent with the product's limited real-world deployment footprint.

SQL injection in Microsoft SharePoint Server Subscription Edition allows any network-authenticated low-privilege user to exfiltrate sensitive database contents without additional interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that a standard SharePoint account is the only prerequisite, placing sensitive intranet data - documents, user records, site configuration - at risk. Microsoft has released a remediation build (16.0.20326.20082); no public exploits or CISA KEV listing have been identified at time of analysis.

SQL injection in iWebShop-5 (versions 5.0-5.15) allows authenticated high-privilege users to manipulate database queries via the Search argument of the member_list function in controllers/member.php. The CVSS 4.0 vector (PR:H) confirms that administrative credentials are required, constraining the realistic attacker pool but not eliminating risk in multi-tenant or compromised-admin scenarios. A public exploit has been disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure.

Time-based blind SQL injection in the WPML Multilingual CMS WordPress plugin (all versions through 4.9.5) enables authenticated attackers with Subscriber-level access to exfiltrate sensitive database contents via the 'elementIds' parameter. The vulnerability is compounded by an authorization bypass: the plugin's registered authorization callback silently fails to execute, inadvertently granting any authenticated user - regardless of role - access to administrative translation endpoints that are intended to be admin-only. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low privilege bar (Subscriber) and widespread deployment of WPML make this a meaningful data-exposure risk on affected sites.

Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.

SQL injection in SAP S/4HANA's Intercompany Matching and Reconciliation (ICR) module allows a low-privileged authenticated user to exfiltrate sensitive data from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard SAP user account, with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.

Authenticated SQL injection in L-ONE v1.0.0 (a JFinal/JFinalOA-based office automation platform) allows an attacker with a valid low-privileged account to inject crafted SQL through the busid, id, and taskid parameters of the /attachment/getBusinessUploadList endpoint, exposing sensitive records from the backend database. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact) and is reported as CWE-89; there is no CISA KEV listing, EPSS is only 0.15%, and no public exploit code or vendor advisory has been confirmed in the supplied sources.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `id` parameter in `/delete_subject.php` to execute arbitrary SQL queries against the backend database. The vulnerability requires no authentication or user interaction, and a public exploit has been released via a GitHub vulnerability report. Internet-exposed deployments face immediate risk of database enumeration, credential theft, and academic record manipulation.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.

SQL injection in SourceCodester Online Voting System 1.0 allows unauthenticated remote attackers to read and manipulate the application database through the /voting/ajax.php?action=save_category endpoint. The Category parameter is passed directly into a backend SQL query without sanitization or parameterization, enabling classic error-based or UNION-based injection. A public proof-of-concept exploit is available on GitHub, making opportunistic exploitation trivially reproducible with no authentication required.

SQL injection in jaychouchannel's Tourism-Management-System (Java Spring Boot, up to commit 8122bf02) allows unauthenticated remote attackers to manipulate SQL queries by injecting payloads into table, column, xColumn, or yColumn path variables accepted by multiple CommonController endpoints backed by CommonDao. Successful exploitation yields limited data disclosure and modification across the application database. A public proof-of-concept is available via GitHub issue #7, and a patch has been merged as commit d44ec3aa via PR #14.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated low-privilege remote attackers to manipulate the `id` parameter in `/pages/emp_edit1.php`, enabling arbitrary SQL query manipulation against the underlying database. A public proof-of-concept has been published via GitHub (E:P confirmed in CVSS 4.0 vector). The CVSS 4.0 base score of 2.1 reflects limited assessed impact (VC:L/VI:L/VA:L), though real-world SQL injection impact is database-permission-dependent and may exceed this baseline in misconfigured deployments.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/settings_edit.php endpoint to database manipulation via the unsanitized ID parameter. Authenticated attackers with low-privilege access can read, modify, or partially disrupt database contents. A public proof-of-concept has been disclosed on GitHub, materially lowering the exploitation skill threshold for any system running this application.

SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.

SQL injection in itsourcecode Information System Society Membership System 1.0 exposes the database to read and write operations by authenticated remote attackers who manipulate the `student_id` parameter in `/society/check_student.php`. A public proof-of-concept exploit has been disclosed on GitHub. The CVSS 4.0 base score of 5.3 with low-impact ratings across C/I/A appears conservative for a CWE-89 flaw, which typically permits full database extraction and modification via UNION or stacked-query techniques.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Username parameter in /pages/us_transac.php. The CVSS 4.0 vector (PR:L) confirms a login is required, limiting the unauthenticated attack surface, but the impact spans confidentiality, integrity, and availability of the underlying database. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising the likelihood of opportunistic exploitation against any exposed instance.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_transac.php` endpoint to database manipulation via the unsanitized `companyname` parameter. Authenticated remote attackers can inject arbitrary SQL, achieving partial read and write access to the underlying database. A public proof-of-concept exploit exists per GitHub issue reference; no CISA KEV listing has been observed.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries through the `Customer` argument at `/pages/pos_transac.php?action=add`. The flaw enables unauthorized data reading and modification within the application database. A proof-of-concept exploit has been publicly published, lowering the bar for exploitation.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /pages/pro_transac.php?action=add. The vulnerability stems from unsanitized user input passed directly to SQL queries in a PHP backend, enabling data extraction, modification, or denial of service against the underlying database. A public exploit has been disclosed on GitHub, lowering the bar for exploitation.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the firstname parameter in the /pages/cust_transac.php?action=add endpoint, potentially enabling unauthorized data exfiltration, modification, or deletion. The CVSS 4.0 vector confirms authentication is required (PR:L), restricting exploitation to users with at least low-privilege credentials. A public exploit is available on GitHub, lowering the practical barrier for authenticated attackers, though no confirmed active exploitation (CISA KEV) has been identified.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes database contents and integrity to remote low-privileged attackers through an unsanitized ID parameter in the supplier management endpoint /pages/sup_del.php?type=supplier. Public exploit code has been published via a GitHub issue, confirming the vulnerability is reproducible. No vendor patch has been identified, and the product originates from itsourcecode.com, a source-code learning platform whose deployments are likely small-scale or demo environments.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_del.php?type=user to execute arbitrary SQL statements against the backend database. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the attack surface to logged-in users. A public proof-of-concept exploit has been disclosed on GitHub, elevating practical risk despite the moderate base score of 5.3.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate database queries via the room_name parameter passed to the mysqli_query() call in /admin/modal_add_room.php. Exploitation yields limited data disclosure and modification (VC:L/VI:L per CVSS 4.0), consistent with a classic unsanitized input flaw in a PHP/MySQL stack. A public proof-of-concept is available on GitHub, no vendor patch has been identified, and no active exploitation (CISA KEV) has been confirmed.

Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application to full database read and write via the `fname` parameter in `/admin/modal_add_product.php`. The underlying `mysqli_query` call accepts unsanitized user input, allowing remote attackers to craft malicious SQL payloads without any authentication. A public exploit has been disclosed on GitHub, materially increasing the likelihood of opportunistic exploitation.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the unsanitized `course` parameter passed directly to mysqli_query in /admin/modal_add_coursea.php. The vulnerability carries limited but confirmed data exposure and integrity risk (VC:L/VI:L/VA:L per CVSS 4.0). A public proof-of-concept exploit was published to GitHub, lowering the bar for exploitation significantly. No vendor patch has been identified.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `course` parameter in `/admin/modal_add_course2.php` to unauthenticated remote attackers who can manipulate the underlying MySQL database. The vulnerability is rooted in direct, unsanitized input concatenation into a `mysqli_query()` call, yielding bounded but real read, write, and partial availability impact. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the exploitation barrier.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to unauthenticated remote attackers via the `course` parameter passed to `mysqli_query()` in `/admin/modal_add_course1.php`. An attacker can craft a malicious HTTP request to read, modify, or delete database contents without prior authentication, as confirmed by a publicly available proof-of-concept exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N) reflects straightforward remote exploitation with no special conditions, though limited CIA impact scores (VC:L/VI:L/VA:L) suggest partial rather than full database compromise.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL against the application database through the unvalidated `course` parameter in `/admin/modal_add_course.php`. The `mysqli_query` function receives attacker-controlled input without parameterization or sanitization, enabling full database extraction, credential theft, and record manipulation. A public proof-of-concept exploit is available on GitHub; no vendor patch has been identified at time of analysis.

SQL injection in PostgreSQL Anonymizer's anon.import_database_rules() and anon.import_roles_rules() functions enables privilege escalation to superuser-level code execution within PostgreSQL. A low-privileged database user plants a malicious JSON rules document containing crafted object names (such as schema, table, or column identifiers); when a superuser subsequently invokes either import function, the injected SQL executes with superuser privileges, yielding full database compromise. The vendor has released a fix in version 3.1.4; no public exploit has been identified at time of analysis.

SQL injection in Mstfakts College-Management-System exposes the Search Handler endpoint (Front-end/university.php) to unauthenticated remote exploitation via unsanitized book_name and book_author parameters passed directly to mysqli_query(). A working proof-of-concept has been publicly disclosed via GitHub Issue #5, and the project maintainer has not responded to the disclosure, leaving the codebase unpatched. No public exploit identified as actively exploited in the wild at time of analysis, but the low attack complexity and no-authentication requirement combined with public PoC materially elevate practical risk.

Unauthenticated SQL injection in rabindralamsal's inventory-management-system 1.0.0 exposes the login endpoint (index.php) to direct database manipulation via unsanitized username and password parameters. An attacker with network access can craft malicious SQL payloads to bypass authentication, enumerate database contents, or alter stored records without any prior credential or privilege. A public proof-of-concept exploit exists (GitHub issue), making this immediately actionable by low-skill attackers; no patch has been identified.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value.

Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /delete_teacher.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter (CWE-89). A proof-of-concept exploit has been publicly released on GitHub, making opportunistic exploitation straightforward for low-skilled attackers. Attackers with network access to the application can extract, modify, or delete records from the underlying database without supplying credentials.

SQL injection in the Login component of code-projects Task Management System In PHP 1.0 exposes the application's database to unauthenticated remote attackers via the `email` parameter in `/index.php`. The root cause is unsanitized user input passed directly into a SQL query (CWE-89), enabling authentication bypass and arbitrary data extraction. A public proof-of-concept writeup has been published on GitHub, significantly lowering the exploitation barrier; no vendor patch has been identified.

SQL injection in DefaultFuction CRM 1.0.0 allows low-privileged authenticated attackers to manipulate the `ID` parameter in `/modules/customers/delete.php`, enabling unauthorized database read and write operations. A public proof-of-concept exploit is available via a GitHub issue on the vendor's repository, lowering the bar for exploitation. No vendor-released patch has been identified at time of analysis, leaving deployments dependent on compensating controls.

SQL injection in DefaultFuction CRM 1.0.0 allows authenticated remote attackers to manipulate database queries via the ID argument in /modules/orders/delete.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authentication is required, limiting opportunistic mass exploitation. A public proof-of-concept has been disclosed via a GitHub issue against the project repository, meaning the attack path is documented and reproducible. No patch is available at time of analysis.

SQL injection in DefaultFuction CRM 1.0.0 allows remote attackers with low-privilege accounts to manipulate the underlying database via the unsanitized ID parameter in /modules/orders/edit.php (CWE-89). A publicly available exploit has been published on the project's own GitHub issue tracker, lowering the bar for exploitation considerably. No vendor patch has been identified at time of analysis.

SQL injection in code-projects Content Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the user_name parameter in /login.php. Because the vulnerable endpoint is the authentication form itself, successful exploitation can achieve authentication bypass - granting admin-level access without credentials - as well as full database enumeration. A public proof-of-concept exploit has been published to GitHub, materially lowering the bar for exploitation.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate the `ID` parameter in `/pages/trans_view.php`, enabling arbitrary database read and write operations. The vulnerability is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), affecting version 1.0 with no version range ambiguity per the CPE wildcard. A public exploit has been released and is available for use in attacks, raising the practical risk above the moderate CVSS 4.0 score of 5.3 suggests.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.

Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the login endpoint `/ajax.php?action=login` to database manipulation via an unsanitized Username parameter. A remote attacker with no credentials can craft malicious SQL input to bypass authentication, extract database contents, or alter voting records. A public proof-of-concept exploit has been disclosed on GitHub (CVE exploit issue #1), elevating practical risk above the moderate CVSS 4.0 score of 6.9.

Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/ajax.php?action=delete_category`. Because the endpoint accepts user-supplied input without parameterization or sanitization, an attacker can craft malicious SQL payloads to read, modify, or delete database contents - including voter credentials, vote tallies, and administrative account data. A public proof-of-concept exploit exists per VulDB submission; no vendor patch has been identified at time of analysis. No public exploit identified at time of analysis is contradicted by the POC flag - POC is confirmed publicly available.

Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the `/ajax.php?action=delete_voting` endpoint to arbitrary database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote exploitation with no authentication or preconditions, and a public proof-of-concept has been disclosed on GitHub. An attacker can read, modify, or delete voting records depending on the database user's privileges, with potential to undermine the integrity of any election or poll managed by the application.

SQL injection in SourceCodester Online Voting System 1.0 exposes the /ajax.php?action=save_user endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. A public proof-of-concept exploit is available on GitHub, enabling database extraction or manipulation without authentication. The CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation, though impact is bounded at the database layer rather than full system compromise.

SQL injection in the Video Player for YouTube WordPress plugin (versions before 2.1.0) allows authenticated users holding the Contributor role or higher to inject arbitrary SQL commands via unsanitized input, enabling them to read any data stored in the underlying WordPress database. The scope change reflected in the CVSS vector (S:C) indicates that exploitation extends reads beyond the plugin's own tables to potentially include WordPress user credentials, secrets, and configuration data held elsewhere in the database. A public PoC exists via WPScan, but EPSS sits at 0.16% and CISA has not added this to KEV, indicating low observed exploitation activity.

SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-level access or above to append arbitrary SQL to an unescaped identifier, exfiltrating the full WordPress database including hashed credentials for all user accounts. The scope change (S:C) in the CVSS vector reflects that credential exposure extends impact beyond the attacker's own session to all other platform users. A publicly available proof-of-concept is documented by WPScan, and the vendor has released a remediated version (6.3.0).

SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the `mobile` parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.

Blind SQL injection in Emlog CMS Pro's `User_Model::getUserDataByLogin()` function allows a remote attacker who controls the application's AUTH_KEY to enumerate database contents via the authentication cookie validation path. The `$account` value read from the HMAC-signed cookie is interpolated directly into SQL with no sanitization; the HMAC guard, which requires AUTH_KEY to forge, is the sole access barrier before the vulnerable query executes. All Emlog Pro releases before 2.6.16 are affected; the vendor released a confirmed patch at the pro-2.6.16 tag. No public exploit code or active exploitation has been identified at time of analysis.

SQL injection in code-projects Vehicle Management System 1.0 allows remote unauthenticated attackers to manipulate the busid parameter in /busprofile.php to inject arbitrary SQL into the underlying database. The CVSS 4.0 vector confirms no authentication, low complexity, and no user interaction is required for exploitation. A public proof-of-concept exploit is documented on GitHub, making this trivially reproducible against any network-exposed instance.