SQL Injection

Files is a module for managing files inside spaces and user profiles. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `FulltextSearch.class.php`. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

SQL Injection vulnerability in Limesurvey v2.65.1+170522. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability was found in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL injection in code-projects Vehicle Management 1.0 exposes the `/filter.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `from` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit is disclosed on GitHub. Despite the trivial exploitation conditions, EPSS at 0.07% (20th percentile) and absence from the CISA KEV catalog indicate no observed widespread exploitation at time of analysis.

SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate the `vehicle` parameter in `/filter1.php` to execute arbitrary SQL against the backend database. A public exploit was disclosed on GitHub, and the CVSS 4.0 E:P supplemental metric confirms publicly available exploit code, though EPSS remains low at 0.07% (20th percentile), reflecting the obscure deployment footprint of this educational PHP project. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.

SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the unsanitized `from` parameter in /filter2.php. A publicly available proof-of-concept exploit is documented on GitHub, making exploitation trivial against any network-exposed instance. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche deployment footprint rather than low severity - the underlying flaw class is serious but real-world exposure is narrow.

SQL injection in Campcodes Online Hotel Reservation System 1.0 allows authenticated remote attackers to manipulate the room_id parameter in /admin/edit_room.php, enabling data exfiltration and modification with low impact. The vulnerability requires valid login credentials (PR:L) and carries a CVSS 2.1 score reflecting limited scope; however, the public exploit disclosure and EPSS percentile 20 suggest limited real-world exploitation interest despite active availability of proof-of-concept code.

SQL injection in Campcodes Online Hotel Reservation System 1.0 via the room_id parameter in /add_reserve.php allows authenticated remote attackers to execute arbitrary SQL queries, but CVSS 2.1 and EPSS 0.07% (20th percentile) indicate minimal real-world risk despite public exploit availability. The vulnerability requires valid user authentication and produces only low confidentiality, integrity, and availability impact-inconsistent with the 'critical' classification in the initial report.

SQL injection in the login endpoint of Campcodes Online Hotel Reservation System 1.0 enables unauthenticated remote attackers to manipulate the username and password parameters submitted to /admin/index.php, potentially bypassing authentication entirely or extracting the underlying database. A public proof-of-concept exploit is confirmed via GitHub, meaningfully lowering the barrier to attack. Despite the PoC availability, EPSS sits at just 0.07% (21st percentile), consistent with the niche deployment footprint of this PHP educational software rather than suppressed exploitation.

SQL injection in code-projects Vehicle Management 1.0 exposes the `/updatebal.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `company` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept is available on GitHub. Despite the reporter's 'critical' classification, the CVSS 4.0 score of 5.5 with limited CIA impact ratings and an EPSS of 0.07% (20th percentile) indicate low observed exploitation activity; real-world risk is further constrained by the product's narrow deployment footprint as a PHP demo/student project.

SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `vehicle` parameter in /addvehicle.php to execute arbitrary SQL against the backend database. The flaw is network-accessible with no authentication required (PR:N, AV:N per CVSS 4.0 vector) and a public proof-of-concept has been disclosed on GitHub. Despite the public exploit and no-auth attack path, EPSS sits at just 0.07% (20th percentile) and this product is absent from CISA KEV, consistent with the application's extremely limited real-world deployment footprint.

SQL injection in code-projects Vehicle Management 1.0 exposes the `/addcompany.php` endpoint to unauthenticated remote attackers who can manipulate the `company` parameter to execute arbitrary SQL queries against the backend database. The vulnerability (CWE-74) is trivially exploitable with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a proof-of-concept has been publicly disclosed on GitHub. While not listed in CISA KEV and carrying a low EPSS score of 0.07%, the public POC elevates opportunistic exploitation risk for any internet-exposed instances.

SQL injection in code-projects Vehicle Management 1.0 exposes the `/print.php` endpoint to remote unauthenticated database manipulation via the unsanitized `sno` parameter. Any attacker with network access to the application can craft malicious HTTP requests to read or modify backend database contents without authentication, as confirmed by the CVSS 4.0 PR:N metric. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.07% (20th percentile) indicates limited automated exploitation activity at this time; no CISA KEV listing is present.

SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation through the credits parameter of /admin/update_s7.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for exploitation. Despite a network-accessible attack vector with no confirmed authentication barrier, real-world risk is constrained by the product's extremely limited deployment footprint - it is a PHP academic demo project with negligible enterprise presence.

SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via the `credits` parameter in `/admin/update_s5.php`. The CVSS 4.0 vector assigns PR:N, though the admin-prefixed endpoint path introduces ambiguity about authentication enforcement. A publicly available proof-of-concept exploit exists on GitHub, though EPSS sits at just 0.07% (20th percentile), reflecting limited real-world interest likely tied to the product's narrow deployment footprint. No vendor patch has been identified at time of analysis.

SQL injection in Kehua Charging Pile Cloud Platform 1.0 endpoint /sys/task/findAllTask allows authenticated remote attackers to execute arbitrary SQL queries with limited confidentiality and integrity impact. The vulnerability has a publicly available exploit and was disclosed to the vendor without response, though EPSS score of 0.04% suggests low real-world exploitation probability despite public POC availability.

SQL injection in Lingdang CRM versions up to 8.6.4.7 allows authenticated remote attackers to execute arbitrary SQL queries via the function parameter in the delete_user function of crm/WeiXinApp/yunzhijia/yunzhijiaApi.php. Public exploit code exists, and vendor has released patched version 8.6.5.2 to remediate the vulnerability.

SQL injection in code-projects Intern Membership Management System 1.0 allows unauthenticated remote attackers to manipulate the `user_name` and `password` parameters of the `/student_login.php` login endpoint, injecting arbitrary SQL logic into the backend database query. The flaw (CWE-74) can enable authentication bypass, unauthorized access to intern records, and potential data manipulation. Publicly available exploit code exists on GitHub, though EPSS sits at 0.07% (20th percentile) and the product is absent from CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

SQL injection in projectworlds Online Admission System 1.0 exposes the `/adminac.php` endpoint to unauthenticated remote database manipulation via an unsanitized `id` parameter. Any internet-facing deployment of this PHP application allows an attacker to read, modify, or partially disrupt the underlying database without credentials. A public proof-of-concept exploit exists on GitHub, though EPSS exploitation probability sits at just 0.07% (22nd percentile), reflecting the product's extremely narrow deployment footprint rather than reduced exploitability of the flaw itself.

SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the admin AJAX endpoint at /admin/ajax.php?action=save_user to unauthenticated remote attackers who can manipulate the id parameter to inject arbitrary SQL. Based on the CVSS 4.0 vector (PR:N/UI:N/AV:N), no authentication or user interaction is required, enabling direct database read, write, and potential availability disruption. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation, though EPSS at 0.07% (21st percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.

SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/admin/ajax.php?action=delete_recruitment_status`. A publicly available proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed by CISA KEV, and EPSS sits at 0.07% (21st percentile), indicating low observed exploitation interest likely reflecting the product's niche deployment footprint rather than difficulty of exploitation.

SQL injection in Online Farm System 1.0 (/categoryvalue.php) exposes remote unauthenticated attackers a direct path to read, modify, or delete underlying database contents by manipulating the Value parameter. The affected product is a PHP web application identified under CPE cpe:2.3:a:anisha:online_farm_system:1.0. A public proof-of-concept exploit exists on GitHub, though EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate negligible observed exploitation, consistent with the product's extremely limited real-world deployment footprint.

SQL injection in code-projects Online Farm System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying crafted input to the Username parameter of the /register.php registration endpoint. The vulnerability is confirmed as critical by the reporter and a public proof-of-concept exploit is documented in a GitHub issue. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche footprint despite the low technical barrier to exploitation.

SQL injection in Online Farm System 1.0 exposes the unauthenticated password-reset endpoint `/forgot_pass.php` to remote attackers who can manipulate the `email` parameter to inject arbitrary SQL commands against the backend database. A public exploit PoC was disclosed on GitHub (https://github.com/wllovemy/cve/issues/10) at time of reporting, lowering the technical barrier for exploitation. Despite the straightforward, unauthenticated attack surface, EPSS is very low at 0.07% (20th percentile), consistent with the product's minimal real-world deployment footprint and niche audience; no CISA KEV listing exists.

SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `sno` parameter in `/edit1.php`, enabling unauthorized reading, modification, or deletion of backend database contents. A public proof-of-concept is disclosed on GitHub (zgqsdx/cve/issues/1), materially lowering the exploitation barrier despite an EPSS score of 0.07% (20th percentile) that reflects the application's negligible real-world deployment footprint. This vulnerability is not listed in the CISA KEV catalog; no public exploit identified at time of analysis as actively exploited in the wild, though publicly available exploit code exists.

SQL injection in code-projects Vehicle Management 1.0 exposes unauthenticated remote attackers to arbitrary database query manipulation via the `company` parameter in /filter3.php. A public POC has been disclosed on GitHub, enabling database enumeration, credential or record exfiltration, and data modification with no authentication required. Despite the ease of exploitation, an EPSS score of 0.07% (20th percentile) and the absence of a CISA KEV listing reflect the product's negligible real-world deployment footprint - consistent with a tutorial/demo application rather than enterprise software.

SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint to database manipulation via the unsanitized USN parameter. Any network-accessible deployment is vulnerable to unauthenticated remote exploitation - no credentials or special configuration are required. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.07% (20th percentile) indicates no observed widespread automated exploitation at time of analysis, and no CISA KEV listing exists.

SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s8.php endpoint to remote exploitation via a manipulated ID parameter. The unsanitized input is passed directly into a SQL query, enabling an attacker to read, modify, or delete database records. A public proof-of-concept has been disclosed on GitHub; however, EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate no widespread automated exploitation has been observed at time of analysis.

Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s7.php` endpoint to remote database manipulation through an unsanitized `ID` parameter, enabling unauthenticated attackers to read, modify, or delete backend database content. The CVSS 4.0 vector confirms no authentication and no user interaction are required, making this trivially exploitable from the network; a public proof-of-concept has been disclosed on GitHub at https://github.com/vullis0/cve/issues/1. Despite accessible attack conditions, an EPSS score of 0.07% (20th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, likely reflecting the product's extremely limited deployment footprint.

SQL injection in Z-Push IMAP backend allows unauthenticated remote attackers to access, modify, or delete data in linked third-party databases via malicious username values in basic authentication headers. Exploitation requires non-default IMAP_FROM_SQL_QUERY configuration. Publicly available exploit code exists (GitHub PR #161 demonstrates the vulnerability). CVSS 7.9 with network attack vector and no authentication required, though attack complexity increases due to the specific configuration prerequisite. Affects Z-Push versions before 2.7.6.

SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the `/admin/ajax.php?action=save_recruitment_status` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to read, modify, or partially disrupt the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks. No confirmed active exploitation (CISA KEV) has been recorded, and EPSS at 0.09% (25th percentile) reflects minimal observed automated targeting, but the public POC makes internet-facing deployments a realistic target.

SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter of `/admin/update_s8.php`. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-path endpoint raises questions about whether authentication is enforced - a detail not resolved by available data. A publicly available proof-of-concept exploit exists (GitHub issue linked in references), but EPSS remains very low at 0.09% (25th percentile), indicating negligible observed exploitation activity at this time. No vendor-released patch has been identified.

SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write operations via the unsanitized `credits` parameter in `/admin/update_fst.php`. A publicly available proof-of-concept on GitHub (referenced in NVD) documents the exact injection point, lowering the bar for opportunistic attacks against any internet-exposed instance. Despite a moderate CVSS 4.0 score of 5.5 and a low EPSS of 0.09% (25th percentile), the combination of a network-accessible vector, no complexity barriers, and public exploit code makes this actionable for any deployment - no public exploit identified as confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists.

SQL injection in Ncvav Virtual PBX Software versions prior to 09.07.2025 allows remote unauthenticated attackers to manipulate backend database queries, leading to full compromise of confidentiality, integrity, and availability. The flaw was reported by Turkey's national CSIRT (USOM) and carries a critical CVSS 9.8 score, though no public exploit identified at time of analysis and no EPSS data is currently available.

SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulation via an unsanitized `ID` parameter, enabling attackers to read, alter, or destroy database records. The CVSS 4.0 base vector confirms no authentication or user interaction is required (PR:N/UI:N/AV:N), though the endpoint's placement under `/admin/` raises questions about whether real-world deployments enforce access controls. A public proof-of-concept has been disclosed on GitHub; exploitation is not confirmed in CISA KEV and EPSS sits at a low 0.09%, consistent with the product's negligible enterprise footprint.

SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation via an unsanitized `ID` parameter, enabling arbitrary SQL query execution against the backend database. Public exploit code has been disclosed via GitHub (CVE-ZhuChengQing/issues/6), confirming practical exploitability despite an EPSS score of 0.09% (25th percentile) that reflects the product's narrow deployment footprint rather than low technical risk. The vulnerability is not listed in CISA KEV, and no vendor-released patch has been identified at time of analysis.

SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database manipulation via an unsanitized ID parameter. The vulnerability (CWE-74, Injection) allows a remote attacker to craft malicious HTTP requests that alter the intended SQL query, potentially reading, modifying, or deleting records in the underlying database. A public proof-of-concept has been disclosed on GitHub; however, EPSS stands at just 0.09% (25th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis.

SQL injection in Campcodes Courier Management System 1.0 via the ID parameter in /view_parcel.php allows authenticated remote attackers to execute arbitrary SQL queries with limited data exposure impact. The CVSS score of 2.1 reflects constraints imposed by authentication requirements (PR:L) and restricted scope, but publicly available exploit code exists; however, the 0.06% EPSS score indicates minimal real-world exploitation likelihood despite public disclosure.

SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s6.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the application's database. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication barrier and no complexity hurdle, making exploitation straightforward for any internet-reachable deployment. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS sits at just 0.07% (20th percentile) and no CISA KEV listing exists, reflecting the product's extremely limited real-world deployment footprint.

SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /admin/delete_s5.php. Authentication is not required, and a public proof-of-concept exploit is available. Despite high CVSS severity, the EPSS exploitation probability is very low (0.07%), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify database contents via the /admin/delete_s4.php endpoint. Public exploit code is available, increasing the risk of scanning and exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The EPSS score is low (0.09%), indicating a lower likelihood of mass exploitation at this time.

SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in /admin/update_s4.php, potentially leading to unauthorized data modification or extraction. Publicly available exploit code exists, but EPSS indicates a low exploitation probability (0.09%).

SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remote attackers to interact with the backend database without authentication. A public exploit exists but no active exploitation (CISA KEV) has been reported; EPSS probability is very low at 0.09%. The CVSS 4.0 base score of 5.5 reflects low-impact confidentiality, integrity, and availability compromises.

SQL injection in Online Ordering System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL code via the firstname parameter in signup.php. The vulnerability is publicly known and exploit code is available. EPSS exploitation probability is low (0.07%), and no active exploitation in the wild has been reported.

SQL injection in Projectworlds Online Admission System 1.0 allows authenticated remote attackers to manipulate the 'markof' parameter in /admin.php, leading to database queries with limited confidentiality and integrity impact. The vulnerability has publicly available exploit code, though actual exploitation appears limited given the low EPSS score (0.07%) and requirement for authenticated access, suggesting this affects only deployments where admin credentials are already compromised or accessible.

Unauthenticated SQL injection in ABC Courier Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'From' parameter of /report.php. Exploit code is publicly available, but active exploitation has not been confirmed. The product is a niche academic project with low deployment footprint, limiting real-world impact.

SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the phone parameter in /user/dashboard.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though EPSS scores predict low widespread exploitation risk.

SQL injection in Code-Projects Exam Form Submission 1.0 allows remote attackers to inject SQL commands via the email parameter of the /admin/ endpoint. A public exploit is available, but the vulnerability has a low EPSS score (0.07%) and affects a niche project with limited deployment, reducing real-world urgency despite the critical classification.

SQL injection in code-projects Exam Form Submission 1.0 allows authenticated administrative attackers to inject SQL via the 'credits' parameter in /admin/update_s2.php, potentially leading to data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation (CISA KEV) has been confirmed, and EPSS exploitation probability is very low (0.07%).

SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to inject malicious SQL via the 'credits' parameter of /admin/update_s1.php. This can lead to unauthorized data access, modification, or deletion. A publicly available exploit exists, but the vulnerability has a low EPSS score (0.07%) indicating limited exploitation likelihood.

SQL injection in the admin edit_product.php page of the code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries. A publicly available exploit increases risk, though EPSS score is low (0.07%) and no active exploitation has been confirmed in CISA KEV. Attackers can extract or modify data with low impact on confidentiality, integrity, and availability.

SQL injection in code-projects Online Ordering System 1.0 via the Name parameter in /admin/product.php allows remote unauthenticated attackers to execute arbitrary SQL commands. Publicly available exploit code exists, but the EPSS score of 0.07% and low impact CVSS 4.0 score indicate a low likelihood of widespread exploitation. No active exploitation has been reported in the wild (not listed in CISA KEV).

SQL injection in Online Ordering System version 1.0 allows remote attackers to inject arbitrary SQL via the ID parameter of the /admin/delete_member.php endpoint. Public exploit code is available, but the EPSS exploitation probability is low (0.07%), and CISA KEV does not list this vulnerability.

SQL injection in code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the 'un' parameter in /admin/user.php. A publicly available exploit exists, but no active exploitation has been reported (CISA KEV is absent), and EPSS indicates a very low exploitation probability (0.07%).

SQL injection in code-projects Online Ordering System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in the admin user deletion script. Public exploit code is available, but EPSS indicates a low exploitation probability (0.07%) and no active exploitation is confirmed.

SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /manage_user.php, with publicly available exploit code disclosed. Despite a critical classification, the CVSS 4.0 vector reflects low impact (confidentiality, integrity, availability all limited) and EPSS score of 0.06% suggests minimal real-world exploitation probability.

SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the parameter 's' in /parcel_list.php, with publicly available exploit code disclosed. Despite a critical classification in the original report, the CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact constrained by the requirement for prior authentication (PR:L) and absence of scope escalation; EPSS scoring of 0.06% indicates low real-world exploitation probability despite public POC availability.

SQL injection in Engeman Web versions up to 12.0.0.2 allows remote attackers to manipulate database queries via the LanguageCombobox cookie on the password recovery page. Exploit code is publicly available, but no active exploitation is reported; EPSS indicates low probability of widespread exploitation.

SQL injection in Jingmen Zeyou Large File Upload Control through version 6.3 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /index.jsp, with publicly available exploit code and vendor non-responsiveness indicating limited remediation prospects.

SQL injection in Campcodes Courier Management System 1.0 via the ids parameter in /print_pdets.php allows authenticated remote attackers to execute arbitrary SQL queries with limited impact. Despite critical classification, the CVSS v4.0 score of 2.1 reflects low confidentiality, integrity, and availability impact; EPSS exploitation probability is minimal at 0.06% (19th percentile), and the vulnerability requires valid user authentication to trigger.

SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_user.php, affecting data confidentiality and integrity. The vulnerability has publicly available exploit code but carries a very low EPSS score (0.06%, percentile 19%), suggesting minimal real-world exploitation risk despite the critical classification and public disclosure.

SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /edit_staff.php, affecting database confidentiality and integrity with low severity impact. Publicly available exploit code exists, though CVSS 2.1 and EPSS 0.06% indicate limited real-world exploitation probability despite the vulnerability's technical criticality classification.

SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_parcel.php, potentially leading to unauthorized data access or modification. The vulnerability has been publicly disclosed with exploit code available, though CVSS 2.1 and EPSS 0.06% indicate limited real-world impact due to authentication requirement and low technical scope (no confidentiality or integrity impact to the system itself).

SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_branch.php, potentially compromising database confidentiality and integrity. The vulnerability requires valid user credentials (PR:L) but is easily exploitable with low technical complexity. Exploit code has been publicly disclosed, though real-world exploitation likelihood remains low per EPSS score (0.06%).

Remote SQL injection in 1000 Projects ABC Courier Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in /getbyid.php. Exploit code is publicly available and has been disclosed, though the EPSS exploitation probability is low (0.06%). The flaw could lead to unauthorized data access, modification, or database compromise.

SQL injection in PHPGurukul Local Services Search Engine Management System 2.1 allows remote attackers to manipulate database queries through the `editid` parameter of `/admin/changeimage.php`. The flaw is a classic CWE-74 injection vulnerability where unsanitized user input is passed directly into a database query, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS remains low at 0.07% (20th percentile), suggesting limited active targeting at this time. No CISA KEV listing exists.

SQL injection in ABC Courier Management System 1.0 allows remote attackers to inject malicious SQL via the reciver_name parameter in /Add_reciver.php. Publicly available exploit code exists, though no active exploitation has been reported and EPSS probability is low (0.07%). The vulnerability can lead to

SQL injection in itsourcecode Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php, resulting in limited confidentiality and integrity impact. Despite a critical classification in the initial report, the CVSS 4.0 vector assigns a severity of 2.1 with low scope impact and requires authenticated access (PR:L), significantly reducing real-world risk. Public exploit code is available, but the extremely low EPSS score (0.06%, 19th percentile) suggests minimal practical exploitation despite disclosure.

SQL injection in Church Donation System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php. A public exploit is available, and the vulnerability is confirmed by vendor disclosure.

SQL injection in code-projects Food Review System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the occasion parameter in /admin/approve_reservation.php, resulting in limited data confidentiality and integrity impact. Despite a critical classification in the source database, the CVSS 4.0 score of 2.1 reflects the requirement for authenticated access (PR:L) and limited technical impact scope. Publicly available exploit code exists and the vulnerability has been publicly disclosed.

SQL injection in code-projects Public Chat Room 1.0 via the ID parameter in send_message.php allows authenticated remote attackers to execute arbitrary SQL queries, despite a low CVSS 4.0 score of 2.1. The vulnerability requires prior authentication (PR:L) and offers only limited confidentiality impact (VC:L/VI:L/VA:L), but publicly available exploit code exists and the attack vector is network-accessible with low complexity, making it suitable for low-friction post-compromise lateral movement or information disclosure within authenticated environments.

SQL injection in Deer WMS 2 up to version 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the params[dataScope] parameter in the /system/role/list endpoint. The vulnerability has a critically low CVSS score of 2.1 due to limited scope and integrity impact, but exploitation is confirmed possible with publicly available proof-of-concept code. Real-world risk is minimal given the requirement for prior authentication and constrained data access impact.

SQL injection in Deer WMS 2 up to version 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the params[dataScope] parameter in the /system/dept/list endpoint. Despite a critical classification in the initial report, the CVSS 4.0 vector assigns a 2.1 score reflecting low impact across confidentiality, integrity, and availability. Publicly available exploit code exists; however, EPSS scoring at 0.07% (22nd percentile) suggests minimal real-world exploitation likelihood compared to the authorization requirement and limited information disclosure scope.

SQL injection in Deer WMS 2 versions up to 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the params[dataScope] parameter in the /system/role/export endpoint, leading to limited information disclosure. The vulnerability carries a CVSS score of 2.1 despite being classified critical in the original report, reflecting the CVSS v4.0 assessment of low confidentiality, integrity, and availability impact combined with required authentication. Publicly available exploit code exists, but real-world exploitation risk remains minimal due to the low EPSS score (0.07%, 22nd percentile) and authentication requirement.