SQL Injection

SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. A publicly available proof-of-concept exists via WPScan, though exploitation is gated behind WordPress administrator credentials.

SQL injection in code-projects Doctor Appointment System 1.0 permits unauthenticated remote attackers to manipulate backend database queries by supplying crafted input in the `firstname` parameter of `/contactus.php`. The flaw (CWE-89) stems from unsanitized user input concatenated directly into SQL statements, enabling data extraction or modification without any credentials. A public proof-of-concept exploit is available on GitHub, reducing the barrier for opportunistic attacks despite a moderate CVSS 4.0 score of 6.9.

Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 exposes the `/patient/booking.php` endpoint to remote database manipulation via the unsanitized `doc_id` parameter. Attackers with network access can extract patient records, appointment data, and stored credentials, or modify database contents without any authentication. Public exploit code exists on GitHub, significantly lowering the bar for exploitation; no vendor patch has been identified at time of analysis.

SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries through the `ID` parameter of the `getSinglePresp` function in `includes/presp/PrespController.php`. A public exploit has been released via GitHub, lowering the barrier for opportunistic attacks. Successful exploitation could expose sensitive patient records and medical data stored in the backend database, or allow unauthorized data modification.

SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying a crafted value in the ID argument to the viewReq() function within viewReq.php. The attack requires no authentication or user interaction, and a proof-of-concept exploit is publicly available via a GitHub issue. No vendor patch has been identified at time of analysis, leaving deployments with no official remediation path.

SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in the findBySearch() function of addReq.php. The CVSS 4.0 vector confirms network accessibility with no authentication, no complexity, and no user interaction required. Publicly available exploit code exists via a GitHub issue; no CISA KEV listing.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/inv_del.php`, enabling database enumeration, data extraction, and record modification. The application is an educational PHP project from itsourcecode.com with minimal production exposure, and a public proof-of-concept exploit has been published on GitHub. No vendor-released patch has been identified at time of analysis.

SQL injection in light0011 CMS exposes all deployments to unauthenticated remote database compromise through the ChapterModel::searchChapter function, where the `content` argument is passed unsanitized to the Query Builder in App/Home/Controller/ChapterController.class.php. Because the project uses no versioning, every deployed commit of this PHP CMS is affected with no vendor-patched baseline to target. A public proof-of-concept exploit is available via GitHub issue #7, and the project maintainer has not responded to disclosure, leaving no official remediation path.

SQL injection in OASYS sysoa 1.0 lets remote attackers inject arbitrary SQL through the unsanitized 'outtype' parameter of the /outaddresspaging endpoint. The CVSS 3.1 vector (PR:N) indicates no authentication is required, and the advisory claims the flaw can be escalated to arbitrary code execution. A public write-up with proof-of-concept details exists on GitHub, though EPSS estimates only a 0.20% exploitation probability and the CVE is not on CISA KEV - no public exploit is confirmed weaponized in the wild.

Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 allows remote attackers to enumerate and extract database contents by exploiting the email parameter in the patient login endpoint (/patient_login.php) via time-based blind techniques. A public GitHub proof-of-concept documents the exact method, lowering the exploitation bar to script-kiddie level. No patch has been released by the vendor; the product appears to be an educational PHP demo with limited production presence.

SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote authenticated customers to manipulate the backend database via the `proid` parameter in the `addwishlist` function at `/customer/controller.php?action=addwish`. Any valid customer-level session can submit a crafted POST request to extract or modify database contents, including potentially customer PII, credentials, and order records. No KEV listing exists; CVSS 4.0 scores this 5.3 (Medium), reflecting the authentication barrier (PR:L) and limited per-component impact ratings.

SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote attackers to manipulate the ID argument passed to Order::pupdate in the rider order-confirmation endpoint, enabling arbitrary database queries. The vulnerable parameter is processed without sanitization at /rider/orders/controller.php?action=edit&actions=confirm. A public proof-of-concept has been disclosed on GitHub; no KEV listing and no vendor patch are available at time of analysis.

SQL injection in SeaCMS's WeChat integration module allows remote unauthenticated attackers to manipulate database queries through the `Content` parameter processed in `weixin/index.php`. Versions up to and including 13.6 are confirmed affected, and a public proof-of-concept exploit has been published on GitHub. The root cause is reliance on PHP's `addslashes()` for SQL sanitization - a known-insufficient defense that fails to prevent injection in many charset and connector configurations.

SQL injection in the WPvivid Backup, Migration & Staging WordPress plugin (all versions before 0.9.133) allows authenticated WordPress administrators to inject arbitrary SQL through an unsanitized list of identifiers passed directly to database queries. The CVSS scope change (S:C) indicates injected queries may reach beyond the plugin's own data, potentially touching other schemas on the shared MySQL host. A publicly available proof-of-concept has been disclosed via WPScan, though SSVC reports no confirmed active exploitation; vendor-released patch 0.9.133 is available.

SQL injection in the Comments WordPress plugin before 7.6.66 allows unauthenticated remote attackers to read restricted comment content by injecting SQL grammar into an unvalidated query parameter. Affected content includes comments awaiting moderation, spam and trash comments, and comments attached to private or draft posts. The impact is scoped to comment disclosure rather than full database extraction, as the injection manipulates query structure rather than enabling arbitrary SELECT statements. No public exploit identified at time of analysis is contradicted by WPScan confirming publicly available exploit code exists.

SQL injection in Xinhu Rainrock RockOA (versions up to 2.3.2) allows low-privileged remote attackers to manipulate database queries via the `Value` argument in the `toaddval` function at `/index.php?m=index&a=publicsavevalue&ajaxbool=true`. A public proof-of-concept exploit exists, and the vendor did not respond to responsible disclosure, leaving no official patch available. CVSS 4.0 rates impact as uniformly Low across confidentiality, integrity, and availability, suggesting bounded data exposure rather than full database compromise. No public exploit identified at time of analysis meets the CISA KEV threshold.

SQL injection in Chanjet CRM's jxf_dump_table.php endpoint allows remote unauthenticated attackers to manipulate the gblOrgID parameter and execute arbitrary SQL against the backend database. All Chanjet CRM releases through build 20260707 are affected, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no special conditions or credentials are required. A public proof-of-concept is available on GitHub, elevating practical risk above the moderate 6.9 base score; no patch exists because the vendor did not respond to coordinated disclosure.

SQL injection in Xinhu Rainrock RockOA up to version 2.7.6 allows authenticated remote attackers to manipulate backend database queries via the `highorder` argument in the `getOrder` function of `webmain/webmainAction.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring low-privilege authentication, with limited but real confidentiality, integrity, and availability impact. A public proof-of-concept exploit has been published on GitHub (E:P); the vendor did not respond to coordinated disclosure, leaving no official patch available.

HQL injection in Schneider Electric NetBotz 5 models 750 and 755 allows an authenticated attacker on the same adjacent network segment to inject malicious Hibernate Query Language statements through the appliance's web service interface or web UI, gaining limited unauthorized read and write access to the NetBotz database. The CVSS 4.0 score of 5.1 reflects a constrained attack surface - both network adjacency and a valid low-privilege account are prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

SQL injection in zhongyu09 OpenChatBI allows authenticated remote attackers to manipulate queries processed by the incomplete `_validate_sql_safety` function within the text2sql pipeline. Versions 0.2.0 through 0.2.2 ship with zero SQL validation; version 0.3.0 introduced a bypassable validator, and v1.0.0b1/main retains the same incomplete logic with an optional - but non-default - stricter mode. The vendor did not respond to coordinated disclosure, leaving no official patch guidance; no public exploit code or CISA KEV listing has been identified at time of analysis.

SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.

SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.

SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios.

SQL injection in the Persistent Login WordPress plugin (versions ≤ 3.1.0) allows network-accessible, subscriber-level authenticated attackers to extract sensitive database contents by injecting arbitrary SQL via the wppl_device_id cookie. The flaw - CWE-89 caused by missing input escaping and absent query parameterization in the Login History feature - carries a CVSS 6.5 with high confidentiality impact and no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

Second-order SQL injection in the WP EasyCart (Shopping Cart & eCommerce Store) WordPress plugin through version 5.9.2 allows authenticated administrators to extract arbitrary data from the WordPress database. The attack is a two-stage operation: a malicious payload is first written to the ec_pageoption table via the ec_ajax_save_page_options handler without any sanitization, then on subsequent store page renders the value is retrieved and processed through stripslashes() - which strips WordPress's magic-quote escaping - before being concatenated directly into a live SQL query in ec_filter.php. No public exploit has been identified at time of analysis, and the PR:H requirement substantially constrains the realistic attacker population.

Unauthenticated SQL injection in ShopEx ECShop up to version 2.5.1 exposes e-commerce installations to remote database compromise via the cart update endpoint. The vulnerable parameter rec_id in /flow.php?step=update_cart is passed to the flow_update_cart function without sanitization, allowing remote attackers to execute arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed and no vendor patch is available, as the vendor did not respond to the disclosure.

SQL injection in kishan0725 Hospital-Management-System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Contact parameter in /search.php, potentially exposing or modifying sensitive patient and operational records. A public exploit has been released, elevating the risk of opportunistic attacks against any internet-facing instance. No vendor patch exists; the developer did not respond to coordinated disclosure.

Unauthenticated SQL injection in code-projects Online Shopping System 1.0 exposes the backend database through the Search Functionality's `keyword` parameter in `/action.php`. The GitHub-linked proof-of-concept specifically documents a time-based blind injection technique, allowing remote attackers without credentials to enumerate database contents, extract data, and potentially modify records. No public KEV listing exists, but exploit code is publicly available, lowering the bar for opportunistic exploitation.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `ID` parameter in `/pages/inv_searchfrm.php`. Publicly available proof-of-concept exploit code exists (CVSS 4.0 supplemental metric E:P), though the product's tutorial and educational origins on itsourcecode.com severely limit any real-world production exposure. The CVSS 4.0 score of 2.1 reflects the authenticated prerequisite and low impact across confidentiality, integrity, and availability.

SQL injection in Soarkey StudentManagement (学生信息管理系统) allows authenticated remote attackers to read from or manipulate the backing database by supplying malicious input to the `cno` parameter of the `CourseDao.course_ranking()` method. All versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e are affected with no vendor patch available, as the project maintainer has not responded to the disclosure. Publicly available exploit code exists via GitHub issue #33, though no CISA KEV listing is present.

SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial.

SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified.

SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed.

SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies.

SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure.

SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers to manipulate database queries via the unsanitized `ID` parameter in `/pages/inv_edit.php`. Exploitation requires a valid application account (PR:L per CVSS 4.0 vector), and a public proof-of-concept is available on GitHub, lowering the exploitation bar for any user with credentials. The vulnerability is not currently listed in CISA KEV, and the CVSS 4.0 score of 5.3 (Medium) reflects the authentication prerequisite limiting broader impact.

Unauthenticated remote SQL injection in SeaCMS 13.6 and earlier exposes database contents and integrity via the `/zyapi.php?ac=videolist` API endpoint. An attacker with network access can manipulate the `ids` parameter to inject arbitrary SQL, enabling read, write, or deletion of backend database records. A public proof-of-concept exploit has been released, meaning exploitation requires minimal skill and no authentication.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/sup_searchfrm.php endpoint to database manipulation via the unsanitized ID parameter. Low-privileged authenticated attackers can remotely exploit this classic CWE-89 flaw to read, modify, or potentially delete backend database records. A public proof-of-concept exploit has been disclosed via GitHub; no active exploitation or CISA KEV listing has been identified at time of analysis.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the supplier edit endpoint `/pages/sup_edit.php` to authenticated remote attackers who can manipulate the `ID` parameter to interact with the underlying database. The vulnerability allows low-privileged authenticated users to read, modify, or potentially delete database records via crafted SQL payloads. A public exploit has been released (reflected in CVSS 4.0 E:P), though no active exploitation or CISA KEV listing has been identified; the realistic risk is bounded by the product's narrow deployment footprint as a student/demo PHP codebase.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/cust_searchfrm.php` customer search endpoint to database manipulation via an unsanitized `ID` parameter. Authenticated remote attackers with low-privilege access can alter backend SQL queries to read, modify, or delete customer and inventory records. A public proof-of-concept exploit is available, lowering the bar for targeted attacks despite the absence of a CISA KEV listing.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the ID parameter in /pages/pro_edit.php. The vulnerability stems from unsanitized user input passed directly to SQL queries (CWE-89), enabling read and limited write access to the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no active exploitation by KEV standards is confirmed at this time.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/emp_searchfrm.php` endpoint to authenticated remote attackers who can manipulate database queries by injecting malicious SQL through the unsanitized `ID` parameter. Low-privileged users with valid credentials can read, modify, or corrupt application database contents. A public proof-of-concept exploit has been published via GitHub, making active exploitation a credible near-term risk for any internet-exposed instance.

SQL injection in PHPGurukul Student Information System 1.0 exposes the `/student_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter. Remote attackers with low-privilege application credentials can read, alter, or partially disrupt data stored in the backend database. A public proof-of-concept is available on GitHub, lowering the technical barrier for opportunistic exploitation against internet-facing deployments.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the unsanitized 'ID' parameter in /pages/emp_del.php. The CVSS 4.0 vector (PR:L, E:P) confirms exploitation requires a low-privileged authenticated session but no special configuration beyond basic access. A public proof-of-concept exploit has been released, raising the practical risk above what the moderate CVSS score alone suggests; however, this vulnerability is not currently listed in CISA KEV.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote low-privileged attackers to manipulate database queries via the `ID` parameter in `/pages/emp_edit.php`. The vulnerability requires a valid (low-privilege) application account but no further conditions, and a public proof-of-concept exploit is available per the VulDB report. Real-world risk is dampened by the product's narrow deployment footprint - itsourcecode distributes educational/tutorial-grade PHP source code primarily consumed by students, not production deployments.

SQL injection in WP Ultimate CSV Importer WordPress plugin (versions before 9.0) allows authenticated administrators to extract database contents by supplying crafted field values in CSV imports that are passed unsanitized into SQL statements. A publicly available proof-of-concept exists per the WPScan advisory, though the EPSS score of 0.16% (5th percentile) indicates minimal observed exploitation activity. No active exploitation has been confirmed by CISA KEV, and the administrative privilege requirement substantially narrows the realistic attack surface.

SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. No public exploit code has been identified at time of analysis and this CVE is not in the CISA KEV catalog, but the root technique is well-documented in public security literature as the classic GBK/Big5 multi-byte escape bypass.

SQL injection in MongoDB Connector for BI allows a high-privilege user to embed arbitrary SQL in generated DDL output by crafting a collection JSON schema validator description containing unescaped backslash sequences. All versions covered by cpe:2.3:a:mongodb:bi_connector:*:*:*:*:*:*:*:* in deployments that build SQL schemas from collection validators are affected. When an operator or automated pipeline later replays the poisoned SHOW CREATE output against a SQL server, the injected SQL executes with the replaying session's full privileges, potentially exfiltrating data or manipulating schema objects. No CISA KEV designation and no public exploit code are known at time of analysis.

Blind SQL injection in the DP Calendar Joomla extension (versions 5.5.0 through 10.11.2) enables authenticated users holding article update permissions to extract Joomla database contents by saving a crafted article when the DP Calendar content plugin is active. Reported by the Joomla security team and scored CVSS 4.0 6.9, the flaw yields high confidentiality impact but is constrained by a high-privilege prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis.

SQL injection in the NL2SQLTool component of crewai-tools v1.10.2rc1 exposes any application built on this AI agent framework to arbitrary database query execution by remote unauthenticated attackers. The unsanitized sql_query argument is passed directly to the underlying database engine, enabling classic injection attacks against the connected data store. No public exploit code has been identified at time of analysis, and the EPSS score of 0.23% (13th percentile) indicates low current exploitation activity, though the zero-authentication requirement elevates exposure for internet-facing deployments.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin login endpoint to unauthenticated remote exploitation via the email parameter in /admin/ajax.php?action=login2. The flaw allows attackers to manipulate SQL queries sent to the backend database, enabling authentication bypass and potential data exfiltration or modification. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing is present, but the exploit's public availability materially lowers the barrier to exploitation.

SQL injection in Dell PowerProtect Cyber Recovery versions 20.2 and prior enables a low-privileged remote attacker to extract sensitive information from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard user account, with high confidentiality impact and no user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and low privilege bar make this a meaningful risk for environments running affected versions.

SQL injection in ZTE SCP allows authenticated, adjacent-network users to craft malicious database queries that bypass authorization logic and access data outside their permitted scope. The flaw requires valid low-privileged credentials and adjacency to the management network but achieves high confidentiality impact by exposing arbitrary database contents - particularly sensitive in telecom infrastructure contexts. No public exploit code or CISA KEV listing has been identified; ZTE classifies this as high-priority and has published a security bulletin.

SQL injection in the RegistrationMagic WordPress plugin (all versions before 6.0.9.4) permits authenticated administrators to inject arbitrary SQL through an unsanitized parameter. The CVSS Scope:Changed metric indicates the injected query can reach beyond the WordPress application boundary into the underlying database layer, enabling cross-schema data reads. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.19% and SSVC exploitation status of 'none' indicate limited real-world abuse at time of analysis.

SQL injection and unrestricted template file loading in the Tutor LMS WordPress plugin before version 4.0.6 exposes non-public course question-and-answer content to unauthenticated remote attackers. User-supplied values are incorporated directly into database query grammar without validation, and no restriction is enforced on which template file a request may load. Although a publicly available proof-of-concept exists and the flaw is fully automatable with no authentication barrier, the SQL injection is constrained by database engine behavior such that it does not yield arbitrary table extraction - impact is limited to disclosure of restricted course Q&A material. No confirmed active exploitation (CISA KEV) has been reported at time of analysis.

SQL injection in code-projects Simple Inventory System 1.0 exposes the /InventoryManagement/edit.php endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. An attacker with network access can inject arbitrary SQL into backend database queries, enabling unauthorized extraction and modification of all inventory records. Publicly available exploit code exists (CVSS 4.0 E:P), though no CISA KEV listing has been issued, suggesting opportunistic rather than targeted active exploitation at this time.

SQL injection in SililaWijesinghe's PHP-based Food Ordering System allows unauthenticated remote attackers to manipulate the search_box parameter in /search.php, causing the backend database to execute attacker-controlled SQL queries. A public proof-of-concept exploit has been disclosed via GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch available. The CVSS 4.0 vector confirms low-complexity, no-authentication remote exploitability with a confirmed proof-of-concept modifier (E:P).

SQL injection in GazellePW's country-code lookup endpoint exposes authenticated operators to arbitrary database reads via the unsanitized `ip` parameter in requests to `tools.php?action=get_cc`. The CVSS-rated confidentiality impact of C:L is likely understated - a publicly referenced blog post titled '1-click exploit chain for complete GazellePW database compromise' indicates full database exfiltration is achievable. No public exploit identified as confirmed CISA KEV, but exploit chain documentation exists, elevating practical risk for private torrent tracker operators running this codebase.

SQL injection in GazellePW's tags manager endpoint allows remote authenticated users holding moderator-level (users_mod) privileges to execute arbitrary SQL commands against the underlying database. The vulnerability resides in the tagid and type parameters passed via POST to tools.php?action=manage_tags at a specific commit (86c4bedf). A publicly documented exploit chain exists at snaacky.com that claims full database compromise, suggesting the official CVSS impact metrics (C:L/I:L) materially understate real-world severity. No public KEV listing; EPSS is low at 0.28% (20th percentile), consistent with the privilege barrier limiting opportunistic exploitation.

SQL injection in the FluentCRM Pro WordPress plugin (all versions up to and including 3.1.12) enables authenticated attackers holding Author-level access or higher to append arbitrary SQL to existing queries and extract sensitive data from the WordPress database. Reported by Wordfence, the flaw stems from unsanitized user-supplied parameters passed into unparameterized SQL queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-confidentiality CVSS rating reflects meaningful exposure of subscriber lists, CRM data, and potentially credential material stored in the database.

SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate underlying database queries via the journeyService.updateEntry function in versions up to and including 3.0.22. The flaw (CWE-89) is network-reachable but requires a valid user session (PR:L), constraining the attack surface to authenticated users of self-hosted instances. No public exploit code or CISA KEV listing exists at time of analysis; the issue was privately disclosed alongside 17 other vulnerabilities all remediated in the 3.1.0 release.

SQL injection in the Media Sweep - WordPress Media Cleaner plugin (all versions through 1.1.3) exposes WordPress database contents to exploitation via the 'fields' REST API parameter, which lacks proper escaping and parameterization. Authenticated attackers holding administrator-level WordPress credentials can append arbitrary SQL to existing queries, enabling sensitive data exfiltration from the underlying database. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.

SQL injection in WP Project Manager Pro (WordPress plugin by weDevs, all versions through 4.0.1) allows authenticated attackers holding Subscriber-level access or higher to append arbitrary SQL clauses to existing plugin queries, enabling extraction of sensitive data from the WordPress database. The CVSS vector confirms high confidentiality impact with no integrity or availability consequences - the primary risk is database read access, potentially exposing user credentials and application data. No public exploit code or active exploitation has been identified at time of analysis, though the low privilege requirement (any registered WordPress user) meaningfully broadens the viable attacker pool.

Second-order SQL injection in the Events Manager WordPress plugin (all versions through 7.4.0) allows authenticated contributors to extract sensitive data from the WordPress database by exploiting unsafe meta key concatenation in the event and location duplication flow. An attacker with contributor-level access plants SQL metacharacters in a custom event or location meta key via the standard WordPress add-meta interface; WordPress stores these verbatim in wp_postmeta, and when the duplicate action is subsequently invoked, the plugin reads the stored key via get_post_meta() and concatenates it unsafely into an INSERT SQL query. No public exploit has been identified at time of analysis, but Wordfence has published the advisory and the vulnerable code paths in em-event.php and em-location.php are exposed via Trac source references, significantly lowering the barrier to exploit construction.

Unauthenticated SQL injection in SourceCodester Simple Online Food Ordering System 1.0 allows remote attackers to manipulate backend database queries via the unsanitized `Name` parameter in `/fos/admin/ajax.php?action=save_settings`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions required. A public proof-of-concept exploit has been disclosed on GitHub, lowering the operational bar for opportunistic attackers targeting exposed instances.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=confirm_order` endpoint to arbitrary database query manipulation via the unsanitized `ID` parameter. A public proof-of-concept exploit is available on GitHub, materially elevating exploitation risk beyond the base CVSS 4.0 score of 6.9, though no CISA KEV listing has been confirmed at time of analysis. Any internet-exposed deployment running this PHP application is at immediate risk of database enumeration and data exfiltration by unauthenticated remote attackers.

Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.

SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis.

SQL injection in itsourcecode Payroll System 1.0 exposes the pre-authentication login endpoint to unauthenticated remote attackers via the Username parameter handled by admin_class.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction network exploitation with no prerequisites, and the E:P modifier confirms a public proof-of-concept exploit has been disclosed, lowering the skill bar for exploitation. Partial confidentiality, integrity, and availability impact is assessed (VC:L/VI:L/VA:L), consistent with an attacker being able to manipulate or extract payroll database records but not achieve full system takeover.

SQL injection in itsourcecode Library Management System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in editbooks.php. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and affects the book editing function, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit exists, raising the operational risk for any unpatched deployment.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/view_prod.php` endpoint to remote unauthenticated database manipulation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network exploitation with no prerequisites, yielding partial confidentiality, integrity, and availability impact against the backend database. A public proof-of-concept exploit is available on GitHub (referenced via VulDB), though the product's extremely narrow deployment footprint as a SourceCodester tutorial application limits real-world blast radius significantly.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin AJAX endpoint /fos/admin/ajax.php?action=save_user to remote database manipulation via an unsanitized Username parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated network exploitation with no user interaction required, meaning any internet-facing instance is trivially reachable. Publicly available exploit code exists (E:P confirmed in supplemental CVSS vector and referenced GitHub issue), though this vulnerability has not been added to the CISA KEV catalog at time of analysis.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=add_to_cart` endpoint to unauthenticated remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (PR:N) confirms no authentication is required despite the admin path, and a public exploit has been disclosed via GitHub. The CIA impact is rated limited across all three dimensions, consistent with a read/write SQL injection that does not achieve full system compromise.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the customer edit endpoint to database manipulation by authenticated network attackers who can control the ID parameter in /pages/cust_edit.php. The CVSS 4.0 base score of 2.1 reflects limited impact across confidentiality, integrity, and availability, though a public proof-of-concept exploit exists on GitHub. No active exploitation by CISA KEV has been confirmed; the low score and limited deployment footprint constrain real-world priority despite the public exploit.

SQL injection in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System (all versions through 300R004C00B300) allows remote unauthenticated attackers to manipulate backend database queries by injecting payloads into the order or sort parameter of the PlanController.getImmediatePlans API endpoint at /xbreport/api/v1/plamange/plansImmediate. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit has been disclosed via a Feishu document referenced in the VulDB entry, lowering the technical barrier for exploitation. No vendor-released patch has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis.

SQL injection in code-projects Barangay Resident Profiling Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in residents.php. The Resident Search Functionality fails to sanitize user-supplied input before constructing SQL statements, enabling read, write, or denial-of-service impact against the underlying database. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation; however, the product's extremely limited real-world deployment significantly constrains actual attack surface.

SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed.

SQL injection in sambitraj's Student-Management-System exposes multiple user-supplied parameters in the Management Mutation Handler to database query manipulation by authenticated remote attackers. The application uses a rolling release model with no versioned releases; all commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected and no patch has been issued despite responsible disclosure via GitHub issue. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental), though no active exploitation has been confirmed and the CVSS 4.0 score of 2.1 reflects limited rated impact under low-privilege conditions.

SQL injection in the Dashboard component of sambitraj's Student-Management-System exposes the application to remote database manipulation via the roll_no and teacher_name parameters, affecting all commits through 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. A low-privileged authenticated attacker can inject arbitrary SQL to read or modify student records without any patch or vendor response currently available. A public exploit exists via GitHub issue disclosure, though real-world impact is constrained by the project's extremely narrow deployment footprint.

SQL injection in the Media Library Assistant WordPress plugin before version 3.40 allows authenticated users with the Author role to read sensitive database contents by injecting arbitrary SQL via an unvalidated search parameter in a media-library query handler. The scope-changed CVSS vector (S:C) reflects that exploitation can reach data beyond the plugin's immediate database scope, and a publicly available proof-of-concept exists per WPScan's disclosure. No public exploit identified at time of analysis for active exploitation, though the POC lowers the bar for abuse against any WordPress installation running the unpatched plugin.

SQL injection in the Link Whisper Free WordPress plugin (all versions before 0.9.7) enables authenticated users holding the Editor role or above to execute arbitrary SQL queries against the underlying WordPress database, with potential scope change to data beyond the plugin's own tables. Reported by WPScan with a publicly available proof-of-concept, this raises the practical exploitability despite the elevated privilege requirement. No CISA KEV listing indicates active mass exploitation has not been confirmed at time of analysis; a vendor-released patch (0.9.7) is available.

SQL injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 exposes the saveUser function at /public/submit.php to database manipulation through the unsanitized Researcher parameter. The CVSS 4.0 score of 5.3 with PR:L indicates low-privileged authentication is required, limiting but not eliminating risk. A public proof-of-concept exploit is available via a referenced GitHub gist, and no vendor-released patch has been identified at time of analysis.

SQL injection in itsourcecode Hospital Management System 1.0 permits authenticated low-privilege users to manipulate database queries through the `delid` parameter of `/viewappointmentpending.php`, potentially exposing or corrupting patient appointment records. The CVSS 4.0 vector (PR:L) confirms exploitation requires a valid application account, narrowing the realistic attack surface despite network reachability. Publicly available exploit code (confirmed by E:P in the CVSS 4.0 vector) exists, modestly elevating practical risk; however, no CISA KEV listing indicates no confirmed in-the-wild exploitation at time of analysis.

SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the email parameter of the password-recovery.php script. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public proof-of-concept exploit is available on GitHub, lowering the skill threshold for opportunistic attacks. No active exploitation has been confirmed in CISA KEV at time of analysis, and impact is rated partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L).

SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the unauthenticated password-reset endpoint (/apartment-visitor/forgotpw.php) to remote database manipulation via the `secode` parameter. A publicly available proof-of-concept exploit exists, lowering the bar for exploitation. Affected deployments risk partial database read and write access without any prior authentication, as confirmed by the CVSS 4.0 vector (PR:N, UI:N). No KEV listing exists, and exploitation is expected to remain opportunistic and targeted to organizations running this niche PHP application.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_category` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to read or modify the underlying database. The CVSS 4.0 vector confirms no authentication, no user interaction, and no special conditions are required to exploit the flaw. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks against any internet-facing deployment.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin panel's category management endpoint to database manipulation by authenticated remote attackers via the unsanitized `ID` parameter in `/admin/ajax.php?action=save_category`. The vulnerability is a classic CWE-89 flaw in a PHP application with no vendor patch available. A public proof-of-concept exploit exists on GitHub, though no CISA KEV listing confirms active widespread exploitation at time of analysis.