SQL Injection

SQL injection in code-projects Online Event Judging System 1.0 via the crit_id parameter in /edit_criteria.php allows authenticated remote attackers to manipulate database queries with low confidentiality and integrity impact. Exploitation requires valid user authentication but can be executed remotely with no user interaction. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) indicates this vulnerability has minimal real-world exploitation probability despite public disclosure.

SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/remove-announcement.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. Publicly available exploit code exists, but EPSS exploitation probability is extremely low (0.01th percentile), suggesting the vulnerability requires authenticated access and offers minimal real-world payoff despite network accessibility.

SQL injection in SourceCodester Online Student Result System 1.0 exposes remote unauthenticated attackers a direct path to manipulate backend database queries via the unsanitized `id` parameter in `/view_result.php`. Successful exploitation can yield unauthorized access to student result records, partial data modification, and limited availability disruption. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% (8th percentile) signals negligible observed exploitation activity, consistent with the product's narrow educational/demo deployment footprint rather than any technical barrier to exploitation.

SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the contestant_id parameter in /edit_contestant.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a publicly available exploit and low EPSS score (0.03%), suggesting it poses minimal real-world risk despite public exploit availability.

SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_contestant.php, enabling database queries with limited data access. The vulnerability has low real-world risk despite public exploit availability, as it requires valid user authentication and produces only limited information disclosure (CVSS 2.1, EPSS 0.03%), though organizations running this application should apply fixes promptly to eliminate the attack vector entirely.

SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_judge.php, enabling limited data extraction with low confidentiality impact. The CVSS 2.1 score reflects the authentication requirement and bounded scope, but publicly available exploit code exists; however, the 0.03% EPSS percentile indicates minimal real-world exploitation probability despite public POC availability.

SQL injection in AMTT Hotel Broadband Operation System (HiBOS) 1.0 exposes hotel network management infrastructure to unauthenticated remote attackers via the `uid` parameter in `/user/portal/get_expiredtime.php`. An attacker with network access to the management portal can manipulate the parameter to read, modify, or partially disrupt the underlying database without any credentials. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, and no patch has been released.

SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the content parameter in /ajax/action.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS scoring (0.03%) suggests minimal real-world exploitation despite public POC availability. The vulnerability requires prior authentication, significantly limiting practical attack surface.

SQL injection in CLTPHP 3.0 exposes the application's database to unauthenticated remote attackers via the `keyword` parameter in the `/home/search.html` search endpoint. The vulnerability stems from unsanitized user input being passed directly into SQL query construction, enabling data extraction and potential modification. A public proof-of-concept exploit has been disclosed (E:P in the CVSS 4.0 vector), though EPSS of 0.03% at the 7th percentile indicates low observed exploitation activity and no CISA KEV listing at time of analysis.

SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the ID parameter in clientdetails/welcome.php, enabling database queries with limited scope impact. CVSS 2.1 reflects low severity due to authentication requirement (PR:L) and limited confidentiality/integrity exposure (VC:L/VI:L), though publicly available exploit code exists and EPSS scoring (0.03%, 8th percentile) indicates minimal real-world exploitation likelihood despite public POC availability.

SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/check-attendance.php, resulting in limited confidentiality and integrity compromise. The vulnerability requires valid administrator credentials, has publicly available exploit code, but carries very low real-world risk with an EPSS score of 0.03% due to authentication requirements and limited impact scope (CVE4.0 vector shows only partial confidentiality/integrity loss, no availability impact).

SQL injection in code-projects Automated Voting System 1.0 allows authenticated remote attackers to manipulate the Username parameter in /admin/user.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid login credentials (PR:L) and has publicly available exploit code, though real-world exploitation risk is minimal given the CVSS 2.1 score and 0.03% EPSS percentile.

SQL injection in projectworlds Advanced Library Management System 1.0 exposes the application's database through the unsanitized `keywords` parameter on `/index.php`, exploitable by any unauthenticated remote attacker. The CVSS 4.0 score is 5.5 (Medium), with low-level confidentiality, integrity, and availability impact against the vulnerable system and no scope change to subsequent systems. A public proof-of-concept exploit exists (E:P in the provided vector), though EPSS sits at just 0.03% (9th percentile), consistent with the highly niche deployment footprint of this product; no public exploit identified at time of analysis for widespread campaigns.

SQL injection in SourceCodester Best House Rental Management System 1.0 allows high-privilege remote attackers to manipulate the house_no parameter in the save_house function of /admin_class.php, achieving limited confidentiality and integrity impact. Publicly available exploit code exists but exploitation requires administrative credentials (PR:H), significantly restricting real-world attack surface despite the CVSS 4.0 network vector.

SQL injection in projectworlds Online Shopping System 1.0 exposes database contents to unauthenticated remote attackers via the `keywords` parameter in `/login_submit.php`. The attack requires no credentials, no user interaction, and carries low access complexity, making it trivially scriptable against any exposed instance. Publicly available exploit code exists per a GitHub proof-of-concept, though the EPSS score of 0.03% (9th percentile) reflects the product's limited real-world deployment footprint; no confirmed active exploitation (CISA KEV) has been observed at time of analysis.

SQL injection in SourceCodester Best House Rental Management System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in the login2 function of /admin_class.php, enabling authentication bypass or database enumeration. A public proof-of-concept exploit has been published on GitHub, confirming exploitability. No KEV listing and a low EPSS score (0.03%, 8th percentile) suggest exploitation remains opportunistic and low-volume, consistent with the niche deployment footprint of this PHP script.

SQL injection in the Charitable WordPress plugin versions up to 1.8.8.4 allows authenticated users with Subscriber-level access to extract sensitive database information via the donation_ids parameter due to insufficient escaping and lack of prepared statements. The vulnerability requires a paid donation to exploit and affects the donation query processing logic. No public exploit code or active exploitation has been confirmed at the time of analysis, though the flaw is straightforward to weaponize given the low attack complexity and documented vulnerable code path.

Unauthenticated SQL injection in Aksis Technology Netty ERP versions prior to V.1.1000 allows remote attackers to manipulate backend database queries with full confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is rooted in improper neutralization of special elements in SQL commands (CWE-89), and no public exploit has been identified at time of analysis, though the Turkish national CSIRT (USOM) has issued a public bulletin tracking this issue.

SQL injection in RapidResult WordPress plugin versions up to 1.2 allows authenticated attackers with contributor-level permissions to extract sensitive database information via insufficient escaping of the 's' parameter. The vulnerability affects all versions through 1.2 and requires valid WordPress account credentials, limiting exposure to sites where user registration is enabled or internal contributors exist.

SQL injection in the WooCommerce Advanced Coupons plugin (<= 4.6.8) allows authenticated attackers with administrator privileges to execute arbitrary SQL queries, potentially extracting sensitive data from the database. Exploitation requires high-level access rights, and no active exploitation or public exploit has been reported. EPSS score is very low (0.03%), indicating low probability of widespread exploitation.

SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands. Exploitation can exfiltrate sensitive database contents (C:H) and, to a limited degree, affect data availability (A:L). The vulnerability currently has no known public exploit, and EPSS predicts very low exploitation probability (0.04%).

Blind SQL injection in Crocoblock JetSearch plugin (WordPress) versions up to 3.5.10 allows unauthenticated remote attackers to extract database contents via crafted search queries. The vulnerability carries a critical CVSS 9.3 score due to network-based exploitation requiring no authentication or user interaction, though EPSS exploitation probability remains low at 0.04% (12th percentile), and no public exploit identified at time of analysis. The flaw enables data exfiltration from WordPress databases hosting sites using the vulnerable search plugin.

SQL injection in WordPress SMS Alert Order Notifications plugin through version 3.8.5 allows remote unauthenticated attackers to extract sensitive database contents via network-accessible injection points. The vulnerability achieves scope change with high confidentiality impact, enabling cross-boundary data exfiltration from the WordPress database. EPSS data unavailable; not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis, though the unauthenticated remote attack vector presents significant risk for WordPress installations using this plugin.

SQL injection in the Hydra Booking WordPress booking plugin (versions through 1.1.10) allows authenticated users with low privileges to extract sensitive data from the underlying database, with a scope-changed CVSS rating indicating the injection may reach beyond WordPress-specific tables to other databases accessible by the shared MySQL user. The vulnerability requires only a low-privilege account (PR:L) and no user interaction, making it exploitable by any registered WordPress user. No public exploit code or active exploitation has been identified; EPSS stands at 0.07% (21st percentile), suggesting low real-world exploitation activity at time of analysis.

SQL injection in the AnyComment WordPress commenting plugin (versions through 0.3.6) allows authenticated low-privilege users to extract data from the underlying WordPress MySQL database by sending crafted requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection can traverse beyond the plugin's own tables and reach the full WordPress database schema - including wp_users, wp_options, and other sensitive stores. No public exploit identified at time of analysis; EPSS at 0.03% (8th percentile) reflects very low current exploitation likelihood.

SQL injection in Email Tracker plugin for WordPress (versions up to 5.3.15) allows authenticated administrators to extract sensitive database information via the 'orderby' parameter due to insufficient escaping and query preparation. CVSS 4.9 reflects high confidentiality impact but requires high-privilege authenticated access; no public exploit code or active exploitation confirmed at analysis time.

SQL injection in Microchip TimeProvider 4100 Grandmaster (firmware <2.5) allows adjacent network attackers with low-level privileges to achieve high integrity and availability impact across system and vulnerable components. EPSS exploitation probability is low (0.03%, 9th percentile) with no public exploit identified at time of analysis. Authentication requirements indicate PR:L (low privileges required) per CVSS vector. Attack complexity is low but requires present attack timing conditions (AT:P).

SQL injection in Vvveb up to version 1.0.7.3 allows authenticated high-privileged remote attackers to execute arbitrary SQL queries through the Raw SQL Handler import function in admin/controller/tools/import.php. The vulnerability requires administrative credentials and has been publicly disclosed with exploit code available, though EPSS modeling indicates low real-world exploitation probability at 0.04%.

SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to manipulate the orderField parameter in the /DeviceState.do?Action=Query endpoint, potentially extracting or modifying database contents. The vulnerability requires valid credentials but carries minimal confidentiality and integrity impact per CVSS scoring. Public exploit code is available, though EPSS exploitation probability remains low at 0.03%, suggesting either limited technical feasibility, narrow applicability, or defensive measures in typical deployments.

SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to execute arbitrary SQL queries via the sortField parameter in the /DeviceFault.do?Action=Query endpoint. While the CVSS score is low (2.1) due to limited scope and confidentiality impact, publicly available exploit code exists and the vulnerability requires only low-privilege authentication. The vendor has not responded to early disclosure attempts, leaving no patch path available.

SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to execute arbitrary SQL queries via the orderField parameter in the /MemoryState.do?Action=Query endpoint, potentially exposing or modifying database contents. Publicly available exploit code exists, but the CVSS score of 2.1 reflects low confidentiality, integrity, and availability impact with no scope change. The vendor did not respond to early disclosure.

SQL injection in Streamax Crocus 1.3.40 allows authenticated remote attackers to manipulate the orderField parameter in the /RepairRecord.do?Action=QueryLast endpoint, enabling database query manipulation with limited confidentiality and integrity impact. Publicly available exploit code exists and the vendor has not responded to early disclosure notification. Despite a low CVSS score of 2.1, the combination of public exploit availability and vendor non-responsiveness increases real-world risk, though exploitation requires valid user credentials and produces only low-severity data exposure.

SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in the /cms/model/hasUse function. The vulnerability has low immediate impact (CVSS 2.1) but carries elevated real-world risk due to publicly available exploit code, authenticated but network-accessible attack vector, and vendor non-responsiveness to disclosure. Exploitation requires valid user credentials but no user interaction or special conditions.

SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to manipulate the cid parameter in the /cms/article/update endpoint, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires valid user authentication and has publicly available exploit code, but carries low real-world risk due to the CVSS 2.1 score and minimal EPSS probability (0.02%). The vendor has not responded to early disclosure notifications.

SQL injection in ChanCMS up to version 3.3.2 allows authenticated remote attackers to manipulate the cid parameter in the /cms/article/findField endpoint, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires valid user authentication (PR:L in CVSS 4.0) and publicly available exploit code exists, but real-world exploitation risk remains low due to minimal data confidentiality/integrity impact (VC:L/VI:L) and only 0.02% EPSS exploitation probability, suggesting this is a low-priority SQL injection compared to unauthenticated or higher-impact variants.

PHP object injection in Vfront 0.99.52's mexcel.php endpoint exposes an unauthenticated POST parameter directly to unserialize() without class restrictions, enabling remote attackers to instantiate arbitrary PHP objects. Depending on exploitable gadget chains present in the Vfront codebase or its PHP dependencies, this can escalate to remote code execution, SQL injection, path traversal, or denial of service. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.40% (32nd percentile), consistent with the absence of a CISA KEV listing.

SQL injection in the TARIFFUXX WordPress plugin up to version 1.4 allows authenticated attackers with Contributor-level or higher privileges to inject malicious SQL commands via the 'id' attribute in the 'tariffuxx_configurator' shortcode, enabling unauthorized extraction of sensitive database information. The vulnerability exploits insufficient input sanitization in SQL query construction and requires authenticated access, resulting in a CVSS 6.5 (medium-high) rating with confirmed confidentiality impact but no availability or integrity compromise.

SQL Injection in onOffice for WP-Websites plugin (versions ≤6.5.1) allows authenticated attackers with Editor-level access or above to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'order' parameter. The vulnerability requires high privileges and user interaction is not needed, resulting in a CVSS score of 4.9 with confirmed confidentiality impact but no integrity or availability compromise.

SQL injection in itsourcecode Online Examination System 1.0 allows remote attackers to manipulate the Username parameter of /index.php to execute arbitrary SQL commands, compromising database confidentiality, integrity, and availability. Public exploit code exists, but the extremely low EPSS score (0.01%) indicates minimal real-world exploitation likelihood. No vendor patch is available.

Blind SQL injection in SFS Consulting's Winsure platform (all versions through the 21.08.2025 release) allows remote unauthenticated attackers to manipulate backend database queries via crafted input. The flaw carries a CVSS 9.8 rating reflecting network-reachable, low-complexity exploitation with no privileges or user interaction required, and no public exploit identified at time of analysis. The advisory was issued by Turkey's national CERT (USOM), suggesting regional relevance to Turkish insurance-sector deployments.

SQL injection in Cats Information Technology's Aykome License Tracking System (versions prior to the 06.10.2025 build) allows remote unauthenticated attackers to manipulate backend database queries via crafted input. The flaw carries a critical 9.8 CVSS score with full confidentiality, integrity, and availability impact, though EPSS rates near-term exploitation probability at only 0.04% and no public exploit identified at time of analysis. The vulnerability was disclosed by Turkey's national CERT (USOM) under advisory TR-25-0332.

SQL injection in Automated Voting System 1.0 allows high-privileged remote attackers to manipulate the Password parameter in /admin/update_user.php, potentially causing limited confidentiality and integrity impacts. The vulnerability requires admin-level privileges (PR:H) to exploit and has publicly available exploit code, but carries very low real-world risk due to EPSS of 0.01% and the high privilege requirement that limits practical attack surface.

SQL injection in Automated Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/add_candidate_modal.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a very low CVSS score (2.1) due to requirement for authenticated access and limited scope, but publicly available exploit code exists. Active exploitation is not confirmed in CISA KEV, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite public POC availability.

SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows high-privileged attackers to manipulate the searchdata parameter in /admin/search-appointment.php, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires administrative privileges to exploit and has a publicly disclosed proof-of-concept, though real-world exploitation risk is minimal given the EPSS score of 0.01% and the requirement for high-privilege access.

SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows authenticated high-privilege administrators to execute arbitrary SQL queries via the sername parameter in /admin/manage-services.php. The vulnerability requires high administrative privileges and has publicly available exploit code, though real-world impact is limited by its requirement for already-compromised admin accounts with no lateral movement or privilege escalation capability.

SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate the serv_id parameter in /booking.php, potentially gaining unauthorized access to the database or modifying data. A public exploit is available, though EPSS assigns a low exploitation probability (0.03%). No active exploitation is reported.

SQL injection in the Inferno Online Clothing Store PHP application's login endpoint (/log.php) exposes the cemail and password parameters to unsanitized database queries, enabling unauthenticated remote attackers to extract database contents or bypass authentication entirely. The affected codebase is tracked to commit 827dd42bfbe380e8de76fdc67958c24cf1246208 of the yousaf530 GitHub project. A public proof-of-concept exploit exists per VulDB submission 665475, and the vendor did not respond to responsible disclosure outreach.

SQL injection in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to execute arbitrary SQL queries via the getUserList function in /Manage/getUserList.do, enabling unauthorized data access with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.

SQL injection in jimit105 Project-Online-Shopping-Website allows high-privilege remote attackers to manipulate the product_code parameter in /delete.php, enabling unauthorized query execution against the backend database. The vulnerability affects an unknown function of the Product Inventory Handler component and requires administrative credentials (PR:H). Exploit code has been published, though active exploitation remains unconfirmed by CISA KEV. EPSS score of 0.02% indicates minimal real-world exploitation probability despite CVE assignment.

SQL injection in SourceCodester Best Salon Management System 1.0 allows unauthenticated remote attackers to manipulate the ServiceId parameter in /panel/add_invoice.php, potentially accessing or modifying database contents. Public proof-of-concept code is available, though EPSS indicates low exploitation probability (0.03%) and no active exploitation is confirmed.

SQL injection in SourceCodester Best Salon Management System 1.0 allows remote attackers to compromise the application database via the editid parameter in /panel/edit-appointment.php. Publicly available exploit code exists, and the vulnerability can be triggered without authentication. EPSS score is 0.03%, indicating low exploitation probability despite the easy remote attack vector.

SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in /addcategory.php, compromising data confidentiality and integrity. The vulnerability has publicly available exploit code and is confirmed to have limited scope impact (affecting only data confidentiality, integrity, and availability of specific queries); however, EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation likelihood despite public availability of proof-of-concept code.

SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /addproduct.php. The vulnerability has low practical risk despite public exploit availability due to CVSS 2.1 scoring and minimal confidentiality/integrity impact, though it requires prior authentication. EPSS exploitation probability is extremely low at 0.03% percentile, suggesting limited real-world attack interest despite public POC availability.

SQL injection in SourceCodester Simple Inventory System 1.0 via the uemail parameter in /user.php allows authenticated remote attackers to manipulate database queries with low impact. CVSS 2.1 reflects the low severity due to authentication requirement and limited scope, but a public exploit exists and EPSS percentile of 8% indicates below-average real-world exploitation likelihood despite POC availability.

SQL injection in SourceCodester Simple Inventory System 1.0 via the editBrandName parameter in /brand.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The CVSS 2.1 score reflects limited scope (authenticated access required, low impact to CIA triad), but publicly available exploit code exists despite minimal real-world exploitation probability (EPSS 0.03%, 8th percentile).

SQL injection in code-projects E-Banking System 1.0 allows unauthenticated remote attackers to manipulate database queries via the username and password parameters in the registration form. Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating limited real-world risk despite the ease of exploit.

SQL injection in iPynch Social Network's Search component allows authenticated remote attackers to manipulate queries and access or modify database content with low complexity exploitation. The vulnerability affects the product up to commit b6933b6d7f82c84819abe458ccf0e59d61119541, and public exploit code has been released, though the EPSS score of 0.03% and CVSS base score of 2.1 suggest limited real-world exploitation probability despite the low attack complexity and public availability of proof-of-concept materials.

SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the uid parameter in /admin/update-profile.php, enabling arbitrary database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.04% and CVSS 2.1 severity indicate low real-world exploitation probability despite low barriers to attack (network-accessible, low complexity, no user interaction required).

SQL injection in projectworlds Online Food Ordering System 1.0 exposes the `/all-orders.php` endpoint to unauthenticated remote exploitation via the unsanitized `Status` parameter, enabling attackers to read, modify, or delete backend database contents. A proof-of-concept exploit has been publicly disclosed on GitHub, lowering the barrier for opportunistic exploitation. No vendor-released patch has been identified; the product is an academic/demo PHP application with very limited production deployment.

SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /editproduct.php, with publicly available exploit code demonstrating the vulnerability. Despite a low CVSS score of 2.1, the vulnerability requires valid credentials and produces limited confidentiality impact, explaining the minimal EPSS exploitation probability of 0.03%.

SQL injection in SourceCodester Online Student Result System 1.0 allows unauthenticated remote attackers to inject SQL commands via the Username field on the /login.php page. Exploit code is publicly available, but EPSS score of 0.03% (8th percentile) indicates a low likelihood of widespread exploitation, and the product is not listed in CISA's Known Exploited Vulnerabilities catalog.

SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in editcategory.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite remote network accessibility and low attack complexity.

SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to perform low-impact database manipulation via the /forgot-password.php email parameter. Public exploit code is available, though no active exploitation has been reported (not listed in CISA KEV), and EPSS signals very low real-world exploitation

SQL injection in code-projects E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_id parameter in /pages/product_add_qty.php, potentially leading to unauthorized database access or data disclosure. The vulnerability has a CVSS score of 2.1 with low impact across confidentiality, integrity, and availability, but public exploit code exists and may lower the exploitation barrier despite the requirement for prior authentication.

SQL injection in code-projects E-Commerce Website 1.0 allows remote, unauthenticated attackers to manipulate database queries via the order_id parameter in /pages/delete_order_details.php, potentially leading to data theft or modification. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed by CISA KEV, and EPSS probability is very low (0.03%).

SQL injection in Campcodes Online Apartment Visitor Management System 1.0 allows high-privileged remote attackers to manipulate the mobilenumber parameter in /admin-profile.php, potentially leading to unauthorized database access or modification. The vulnerability requires administrative privileges to exploit and has limited confidentiality and integrity impact; public exploit code is available but real-world exploitation risk remains low due to EPSS score of 0.03% and the administrative access prerequisite.

SQL injection in WP Links Page plugin for WordPress (all versions up to 4.9.6) allows authenticated attackers with Subscriber-level access and above to extract sensitive database information via the unescaped 'id' parameter. The vulnerability stems from insufficient input sanitization and lack of prepared statements, enabling attackers to append arbitrary SQL queries to existing database operations. CVSS 6.5 reflects the high confidentiality impact for authenticated remote exploitation with low attack complexity; no public exploit code or active exploitation has been confirmed at analysis time.

SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/actions/delete-equipment.php. The vulnerability requires valid user credentials (PR:L) and has publicly available exploit code; however, the EPSS score of 0.03% and limited impact scope (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite technical exploitability.

SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/edit-equipmentform.php. The vulnerability requires valid user credentials (privilege level L) but no user interaction. Publicly available exploit code exists, though EPSS indicates very low real-world exploitation probability (0.03%, 8th percentile). Despite the public POC, the CVSS 2.1 score and minimal impact scope (VC:L/VI:L/VA:L with no scope change) suggest limited practical risk in most deployments.

SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/delete-member.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid administrative credentials and carries a CVSS score of 2.1 with low confidentiality and integrity impact but no availability risk. Publicly available exploit code exists, though real-world exploitation remains extremely limited based on a 0.03% EPSS score.

SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ename parameter in /admin/equipment-entry.php, enabling database query modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists but real-world risk is minimal due to low EPSS score (0.03%, 8th percentile), limited scope impact, and requirement for authenticated access despite the network attack vector.

SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the plan parameter in /admin/user-payment.php, resulting in limited data access. The vulnerability requires valid login credentials and has low real-world impact due to constrained scope (no server impact, no integrity violation), though publicly available exploit code exists and exploitation probability is minimal per EPSS analysis.

SQL injection in CodeAstro Gym Management System 1.0 via the fullname parameter in /customer/index.php allows authenticated remote attackers to execute arbitrary SQL queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation despite public POC availability, likely due to authentication requirement and narrow deployment scope of this niche management application.

SQL injection in Project Monitoring System 1.0 allows remote attackers to manipulate the uid parameter on the /useredit.php endpoint, potentially exposing or modifying database contents. The exploit code is publicly available, but real-world risk is very low (EPSS 0.03%) and no active exploitation has been confirmed.

SQL injection in code-projects Online Job Search Engine 1.0 via the txtspecialization parameter in searchjob.php allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to unauthorized data access or modification. A publicly disclosed exploit exists, but the affected product is a niche educational project with low real-world deployment, and no active exploitation has been reported.

SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate the txtjob

SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate database queries via the txtusername parameter in /registration.php. The vulnerability enables extraction, modification, or deletion of database contents and could bypass authentication. Exploit code is publicly available, though active exploitation has not been confirmed.

Authentication bypass via SQL injection in code-projects Computer Laboratory System 1.0 allows a remote unauthenticated attacker to log in as a valid user by submitting a crafted 'universal password' in the login form's Password field. The injected SQL manipulates the login query so the authentication check always evaluates true, granting access without valid credentials. Publicly available exploit code exists (PoC published on GitHub), though the low EPSS score (0.42%, 34th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.

SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate database queries via the Search parameter in /pages/user_index_search.php. Exploit code is publicly available, but no active

SQL injection in projectworlds Gate Pass Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the fullname parameter in /add-pass.php. Exploit code is publicly available; no active exploitation has been confirmed (not in CISA KEV). EPSS indicates a very low probability of widespread exploitation (0.03%), likely due to the product's limited deployment.

SQL injection in Simple Leave Manager 1.0’s /user.php via the ‘table’ parameter allows remote unauthenticated attackers to read, insert, or modify database content. Exploit code is publicly available but no active exploitation in the wild has been confirmed; EPSS score indicates very low exploitation probability.

SQL injection in Campcodes Online Learning Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the date_start parameter in /admin/calendar_of_events.php. Publicly available exploit code exists, increasing risk, though the EPSS score is low (0.03%) suggesting limited active exploitation. No patch has been identified at time of analysis.

SQL injection vulnerability in Courier Management System 1.0 allows authenticated remote attackers to manipulate the Shippername parameter in /add-courier.php, enabling database queries to be executed with limited confidentiality and integrity impact. The publicly available exploit code and low CVSS score (2.1) reflect the requirement for valid authentication credentials, limiting real-world risk despite confirmed exploit availability.

SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /admin/category.php, with publicly available exploit code. CVSS score of 2.1 reflects limited confidentiality impact and requirement for low-privilege authentication; EPSS of 0.03% indicates very low real-world exploitation probability despite public POC availability.

SQL injection in code-projects Student Result Manager 1.0 allows authenticated remote attackers to manipulate roll, name, or GPA parameters in Database.java, resulting in limited confidentiality, integrity, and availability impact. The vulnerability requires valid login credentials and has been publicly disclosed with exploit code available, but carries very low exploitation probability (EPSS 0.03%) and minimal security impact due to restricted scope.

SQL injection in Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the state parameter in /cms/admin/state.php, enabling data exfiltration or modification with limited scope. Publicly available exploit code exists; however, the CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world exploitation risk despite the presence of proof-of-concept.

SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/complaint-details.php, leading to limited data exposure. The vulnerability requires valid user authentication and has a publicly available proof-of-concept, but the EPSS score of 0.03% and CVSS impact metrics (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite public availability of exploit code.

SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/register-complaint.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the EPSS score of 0.03% and requirement for prior authentication significantly constrain real-world exploitation risk compared to the CVSSv4 score of 2.1.

SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the Username parameter in /cms/users/index.php and execute arbitrary SQL queries with limited impact to confidentiality, integrity, and availability. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite public exploit availability, likely due to the authentication requirement (PR:L) and constrained impact scope.

SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate the supp_id parameter in /pages/supplier_update.php, potentially reading, modifying, or deleting database data. Exploit code is publicly available, but no active exploitation has been reported and EPSS indicates low exploitation probability (0.04%).