SQL Injection

PHPGurukul Hospital Management System 4.0 contains a critical SQL injection vulnerability in the /user-login.php file's Username parameter that allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, enabling unauthorized access to sensitive hospital patient data, user credentials, and potential system compromise. With a CVSS score of 7.3 and an attack vector requiring only network access and no authentication, this represents an immediate threat to healthcare organizations running affected versions.

SQL injection in PHPGurukul Online Library Management System 3.0 allows authenticated attackers with low privileges to manipulate the stdid parameter in the /admin/student-history.php endpoint, potentially reading or modifying database records. A proof-of-concept exploit is publicly available, but the EPSS exploitation probability is very low (0.04%), indicating limited real-world threat despite a

SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows low-privileged remote attackers to manipulate database queries via the

A critical SQL injection vulnerability exists in code-projects Job Diary 1.0 via the ID parameter in /view-cad.php, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially extract, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, and while the CVSS score is 7.3 (High), the unauthenticated attack vector and low complexity suggest active exploitation is likely. No patch has been confirmed available as of this analysis.

CVE-2025-7594 is a critical SQL injection vulnerability in code-projects Job Diary version 1.0 affecting the /view-emp.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the low attack complexity combined with network accessibility makes this a high-priority threat requiring immediate patching.

CVE-2025-7593 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-all.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate sensitive data, modify records, or disrupt application availability. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high impact across confidentiality, integrity, and availability. This represents an active threat requiring immediate patching.

SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows low-privileged remote attackers to manipulate the 'del' parameter in invoices.php, potentially compromising the backend database. Public exploit code is available, but no active exploitation (CISA KEV) has been detected, and EPSS indicates a very low exploitation probability (0.04%).

SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows authenticated remote attackers to manipulate database queries via the invid parameter in view-invoice.php. An attacker with low-privilege access can exploit this to exfiltrate or modify data. Exploit code is publicly available, but no active exploitation has been confirmed.

Remote SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 via the categorycode parameter in edit-category.php allows low‑privilege authenticated attackers to execute arbitrary SQL commands. Public exploit code is available, but the EPSS score (0.04%) indicates very low exploitation probability, and no active exploitation has been confirmed.

SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows remote authenticated attackers to execute arbitrary SQL commands via the companyname parameter in edit-company.php. A public exploit exists, but no active exploitation has been reported; the EPSS score is low (0.04%), indicating limited exploitation likelihood despite the critical classification in the description.

SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows authenticated low-privilege remote attackers to manipulate database queries by injecting malicious SQL through the `productname` parameter in edit-product.php. A public proof-of-concept has been disclosed via GitHub. Despite being labelled 'critical' by the reporter, the CVSS 4.0 vector scores only 2.1, reflecting constrained low-level impact (VC:L/VI:L/VA:L) and the authentication prerequisite that limits opportunistic exploitation.

CVE-2025-7587 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cover.php endpoint where uname and psw parameters are not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, authentication bypass, and database manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation highly probable in the wild.

SQL injection in PHPGurukul Online Fire Reporting System 1.2 via the 'webtitle' parameter of /admin/manage-site.php enables remote attackers with low privileges to compromise the database. Exploit code is publicly available, although EPSS indicates a very low probability of widespread exploitation (0.04%).

SQL injection in PHPGurukul Online Fire Reporting System 1.2 via the teammember parameter in /admin/add-team.php allows remote attackers to execute arbitrary SQL commands. The vulnerability has a public exploit, but EPSS probability is low (0.04%) and it is not listed in CISA KEV, indicating no active exploitation at this time.

SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated attackers with low privileges to extract or manipulate database data via the teamid parameter of /admin/all-requests.php. A proof-of-concept exploit is publicly available, but EPSS estimates low exploitation likelihood (0.04%).

SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to manipulate the teamid parameter in /admin/assigned-requests.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is very low (0.04%), indicating limited real-world risk despite the public disclosure.

SQL injection vulnerability in code-projects Voting System 1.0 allows remote authenticated attackers to manipulate the ID parameter in /admin/positions_edit.php, potentially leading to unauthorized data access or modification. A public exploit is available, but low CVSS score (2.1) and EPSS (0.04%) indicate limited real-world risk, and no active exploitation has been reported.

SQL injection in Code-projects Voting System 1.0 allows remote authenticated attackers with low privileges to execute arbitrary SQL commands via the ID parameter in /admin/positions_row.php. Publicly available exploit code exists, enabling data theft or manipulation.

SQL injection in FoxCMS admin Video.php allows authenticated attackers to execute arbitrary SQL via the ids parameter. Affects FoxCMS versions up to 1.2.5. Public exploit code exists, but no active exploitation has been reported to CISA KEV; EPSS probability is low (0.04%).

SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows remote authenticated attackers with low privileges to manipulate the teamid parameter in /admin/completed-requests.php, potentially leading to unauthorized data access or modification. A publicly available proof-of-concept exists, but no active exploitation has been confirmed and the EPSS score indicates low real-world exploitation probability.

SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows remote attackers with low-privileged access to execute arbitrary SQL commands via the teamid parameter in /admin/new-requests.php. Exploit code is publicly available, though no active exploitation has been reported and EPSS indicates a low probability (0.04%) of widespread use.

SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to manipulate database queries via the teamid parameter in /admin/team-ontheway-requests.php. Exploit code is publicly available, but exploitation requires low‑privileged administrative access. EPSS remains very low (0.05%), and the vulnerability is not listed in CISA KEV.

SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to execute arbitrary SQL commands via the teamid parameter in /admin/workin-progress-requests.php. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA KEV and the EPSS score is very low (0.04%), indicating limited exploitation likelihood in the wild. The CVSS 4.0 base score of 2.1 reflects low impact and the requirement for low‑privilege authentication.

SQL injection in Online Fire Reporting System 1.2’s admin report page allows authenticated remote attackers to execute arbitrary SQL commands via the fromdate/todate parameters. Public exploit code is available, though EPSS indicates a low exploitation probability of 0.05% and no active exploitation has been confirmed by CISA KEV.

Authenticated SQL injection in code-projects Voting System 1.0 allows a low-privileged attacker to manipulate the description parameter in the admin panel endpoint /admin/positions_add.php, leading to unauthorized data access or modification. Public exploit code is available, but exploitation probability is very low (EPSS 0.04%) and the vector requires authentication; no active exploitation has been confirmed.

SQL injection in code-projects Voting System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /admin/voters_row.php, leading to potential database compromise. Exploit code is publicly available, and no vendor patch exists.

SQL injection in code-projects Voting System 1.0 allows authenticated low-privilege attackers to manipulate the ID parameter in /admin/voters_edit.php, potentially accessing or modifying database contents. A public exploit is available, though exploitation probability is low (EPSS 0.04%) and no active exploitation has been reported.

SQL injection in Voting System 1.0 allows remote attackers with low privileges to manipulate database queries via the firstname and lastname parameters in /admin/voters_add.php. Exploit code is publicly available but the vulnerability has a very low EPSS exploitation probability (0.04%) and no active exploitation has been confirmed by CISA KEV.

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated, low-privilege attackers to manipulate SQL queries via the ID parameter of /admin/manage-users.php. Public exploit code is available, but there is no evidence of active exploitation (not in CISA KEV). Exploitation can lead to unauthorized access, modification, or extraction of database contents, including user credentials.

CVE-2025-7542 is a critical SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System version 3.3, located in the /admin/user-profile.php file where the 'uid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, and exploitation requires no special privileges or user interaction, making it a high-priority threat for affected deployments.

CVE-2025-7541 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /get_town.php endpoint where the 'countryid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the appointment booking system database. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.

CVE-2025-7540 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System 1.0 affecting the /getclinic.php file's townid parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability has been publicly disclosed with exploit code available, creating immediate operational risk for deployed instances.

CVE-2025-7539 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getdoctordaybooking.php file via the 'cid' parameter. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. Exploitation has been publicly disclosed with proof-of-concept availability, and the vulnerability may be actively exploited in the wild.

CVE-2025-7537 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting the /pages/product_update.php file. An unauthenticated remote attacker can manipulate the 'ID' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation indicators suggest immediate remediation is warranted.

CVE-2025-7536 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the /pages/receipt_credit.php endpoint via the 'sid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, indicating active exploitation risk.

CVE-2025-7535 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0, located in the /pages/reprint_cash.php file's 'sid' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploits available, making it an immediate threat to deployed instances.

CVE-2025-7534 is a critical SQL injection vulnerability in PHPGurukul Student Result Management System 2.0, exploitable through the 'nid' GET parameter in /notice-details.php. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the application database. Public exploit disclosure and confirmed attack surface (unauthenticated, network-accessible endpoint) elevate real-world risk despite the moderate CVSS 7.3 score.

CVE-2025-7533 is a SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-details.php file through the job_id parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read, modify, or delete database contents. The vulnerability has a CVSS score of 7.3 (High) with public exploit disclosure and proof-of-concept availability, indicating active exploitation risk in the wild. This is a critical severity issue for all deployments of the affected version with direct database access implications.

SQL injection in the /admin/bwdates-reports-details.php endpoint of Vehicle Parking Management System 1.13 allows remote authenticated attackers to manipulate the fromdate or todate parameters to execute arbitrary SQL queries, potentially compromising the database. A public proof-of-concept exploit exists, but no active exploitation has been confirmed at this time.

CVE-2025-7521 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, specifically in the /admin/index.php file's Username parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate exploitation risk.

SQL injection in PHPGurukul Vehicle Parking Management System 1.13 exposes the admin-facing `/admin/manage-category.php` endpoint to database manipulation via an unsanitized `del` parameter. Authenticated remote attackers can craft HTTP requests to read or modify the underlying database, with a publicly available proof-of-concept exploit already disclosed. No active exploitation has been confirmed in CISA KEV at time of analysis, and the EPSS score of 0.06% places exploitation probability in the 20th percentile.

CVE-2025-7517 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getDay.php file's cidval parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and exploitation requires no special privileges or user interaction, making it an immediate threat to deployed instances.

CVE-2025-7516 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cancelbookingpatient.php endpoint via the 'appointment' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of appointment records and sensitive patient information. Public disclosure and proof-of-concept availability indicate active exploitation risk.

CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.

A SQL injection vulnerability exists in code-projects Modern Bag version 1.0, specifically in the /admin/contact-list.php file where the 'idStatus' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.

CVE-2025-7513 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slideupdate.php endpoint, where unsanitized idSlide parameter input allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploits available, enabling attackers to read, modify, or delete database records with moderate confidentiality, integrity, and availability impact.

CVE-2025-7512 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, affecting the /contact-back.php file's contact-name parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit disclosure and demonstrates active exploitation potential with a CVSS score of 7.3.

SQL injection in Chat System 1.0 allows authenticated remote attackers with low privileges to manipulate backend database queries via the musername parameter in /user/update_account.php. Successful exploitation leads to limited confidentiality, integrity, and availability impact. A public exploit is available, but no active exploitation has been confirmed.

CVE-2025-7510 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/productadd_back.php file, where the 'namepro' parameter is improperly sanitized allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploit code available, and carries a CVSS 7.3 score indicating moderate-to-high real-world risk with low attack complexity. An attacker can extract, modify, or delete database contents without authentication, compromising confidentiality, integrity, and availability of the application.

CVE-2025-7509 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slide.php endpoint via the idSlide parameter. An unauthenticated remote attacker can exploit this with no user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

CVE-2025-7508 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/product-update.php endpoint, where the 'idProduct' parameter is improperly validated before database queries. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially exfiltrating sensitive data, modifying product information, or gaining further system access. The vulnerability has public exploit disclosure and active real-world exploitation is likely given the low attack complexity and lack of authentication requirements.

SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers with low privileges to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-incomingvehicle.php. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed by CISA KEV. The attack is launched remotely, with an EPSS likelihood of 0.06%, indicating very low exploitation probability despite a critical severity rating.

SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows low-privileged authenticated remote attackers to inject arbitrary SQL via the 'del' parameter of /admin/manage-outgoingvehicle.php. This can lead to unauthorized data access or manipulation. A publicly available exploit exists, but no active exploitation (CISA KEV) is confirmed.

SQL injection in PHPGurukul Vehicle Parking Management System version 1.13 allows authenticated low-privileged attackers to manipulate database queries via the 'del' parameter in the admin panel's user management page. Exploit code is publicly available, but no active exploitation has been reported, and the EPSS score (0.06%) indicates a low likelihood of widespread exploitation.

SQL injection in PHPGurukul Vehicle Parking Management System 1.13 permits an authenticated admin-panel user to manipulate the `searchdata` parameter on `/admin/search-vehicle.php`, enabling arbitrary database reads and writes against the underlying MySQL/MariaDB instance. A public proof-of-concept is documented on GitHub; no CISA KEV listing exists. EPSS sits at 0.06% (17th percentile), consistent with the product's niche deployment footprint.

SQL injection in PHPGurukul Vehicle Parking System 1.13 allows authenticated remote attackers to manipulate database queries via the 'viewid' parameter in /admin/view-outgoingvehicle-detail.php. Successful exploitation can result in unauthorized reading or modification of data, though only low-level impacts are expected. Public exploit code exists, but active exploitation is not confirmed.

CVE-2025-7483 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, specifically in the /users/forgot-password.php endpoint's email parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation a significant concern.

SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers to manipulate database queries via the 'vid' parameter in the /users/print.php endpoint. The vulnerability is publicly disclosed with exploit code available, though no active exploitation in the wild has been confirmed. It requires low-privilege authentication for exploitation.

SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows authenticated remote users to manipulate database queries by injecting malicious SQL syntax into the `firstname` parameter at `/users/profile.php`. The advisory notes additional parameters in the same file may be vulnerable, broadening the attack surface. A proof-of-concept is publicly available on GitHub, though no active exploitation is confirmed and EPSS sits at a very low 0.06%, reflecting limited real-world uptake.

CVE-2025-7480 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, located in the /users/signup.php file where the email parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, though no KEV or EPSS data is referenced in the provided intelligence.

SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows an authenticated attacker with low privileges to execute arbitrary SQL commands via the viewid parameter of /users/view--detail.php. A publicly available exploit exists, but no active exploitation has been reported in CISA KEV and EPSS probability is very low (0.06%).

CVE-2025-7478 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/category-list.php file, where the 'idCate' parameter is not properly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with working exploits available, and while classified as critical in the original report, the CVSS 7.3 score indicates moderate-to-high real-world risk with potential for data exfiltration, modification, and denial of service. Active exploitation is likely given public POC availability and the ease of the attack vector.

CVE-2025-7476 is a critical SQL injection vulnerability in code-projects Simple Car Rental System 1.0 affecting the /admin/approve.php endpoint's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, elevating real-world risk despite the CVSS 7.3 score suggesting moderate impact.

CVE-2025-7475 is a critical SQL injection vulnerability in code-projects Simple Car Rental System version 1.0, located in the /pay.php file where the 'mpesa' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. The vulnerability has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk in real-world deployments.

CVE-2025-7474 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /search.php file's Search parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with potential data exfiltration, modification, and application disruption. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability meets the criteria for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active real-world exploitation.

CVE-2025-7471 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /admin/login-back.php endpoint. An unauthenticated remote attacker can inject malicious SQL code via the 'user-name' parameter to compromise confidentiality, integrity, and availability of the application and underlying database. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.

The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled.

CVE-2025-7469 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the product addition functionality (/pages/product_add.php). An unauthenticated remote attacker can manipulate the 'prod_name' parameter to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely in the near term.

CVE-2025-7467 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /product-detail.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high real-world impact with low attack complexity and no authentication requirements.

A critical SQL injection vulnerability exists in 1000projects ABC Courier Management version 1.0 affecting the /add_dealerrequest.php endpoint, where the 'Name' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it an active threat.

CVE-2025-7461 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, located in the /action.php file's proId parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially access, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate confidentiality, integrity, and availability impact; however, the attack requires no authentication or user interaction, making it immediately exploitable in network-accessible deployments.

CVE-2025-7459 is a SQL injection vulnerability in code-projects Mobile Shop version 1.0, specifically in the /EditMobile.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for deployed instances. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected databases.

CVE-2025-7457 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the /admin/manage_movie.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising database confidentiality, integrity, and availability. Public disclosure and exploit availability elevate the risk profile significantly.

CVE-2025-7456 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the /reserve.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the reservation database. Public exploit code is available, indicating active disclosure risk.

CVE-2025-7455 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, specifically in the /manage_reserve.php file's 'mid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or service disruption. Public exploit disclosure and active exploitation potential significantly increase real-world risk despite the moderate CVSS 7.3 score.

CVE-2025-7454 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, specifically in the /admin/manage_theater.php file where the ID parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the theater reservation database. The exploit has been publicly disclosed and is actively exploitable with no authentication required.

A SQL injection vulnerability in WPGYM - Wordpress Gym Management System (CVSS 7.5). High severity vulnerability requiring prompt remediation.

CVE-2025-7436 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the /admin/ajax.php?action=delete_vacancy endpoint where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.

A remote code execution vulnerability in Advantech iView that allows for SQL injection and remote code execution (CVSS 8.8) that allows for sql injection and remote code execution. High severity vulnerability requiring prompt remediation.

CVE-2025-53475 is a SQL injection vulnerability in Advantech iView's NetworkServlet.getNextTrapPage() function that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution within the context of the 'nt authority\local service' account. The vulnerability requires valid user-level credentials but has a high CVSS score of 8.8 due to the combination of high confidentiality, integrity, and availability impact. No KEV or active exploitation data is provided, but the authenticated requirement and network accessibility make this a moderate-to-high priority for organizations deploying Advantech iView.

CVE-2025-52577 is a SQL injection vulnerability in Advantech iView's NetworkServlet.archiveTrapRange() method that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution (RCE) within the LocalService account context. The vulnerability affects Advantech iView and requires user-level authentication, making it a post-authentication attack vector with high severity (CVSS 8.8). While no public POC or KEV status confirmation is available in provided data, the combination of SQL injection leading to RCE on a privileged service account represents significant risk for organizations deploying this network management solution.

CVE-2025-7411 is a critical SQL injection vulnerability in code-projects LifeStyle Store 1.0 affecting the /success.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read/modify sensitive data. Public exploit code is available and the vulnerability is likely actively exploited in the wild, making this a high-priority remediation target despite the moderate CVSS 7.3 score which reflects limited immediate system impact rather than true severity.

The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection vulnerability in the EventCache::find_event_with_relations method of matrix-sdk 0.11 and 0.12 allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. This vulnerability is fixed in 0.13.

CVE-2025-7410 is a critical SQL injection vulnerability in code-projects LifeStyle Store version 1.0, affecting the /cart_remove.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability over the network to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

CVE-2025-7409 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /LoginAsAdmin.php endpoint, where the 'email' parameter is improperly sanitized, allowing unauthenticated remote attackers to inject arbitrary SQL commands. The vulnerability has been publicly disclosed with exploits available, making it actively exploitable in the wild. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected systems.

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate the 'ID' parameter via /ajax.php?action=save_deductions, enabling arbitrary database queries and potential data leakage or modification. The vulnerability is publicly known with exploit code available, though no active exploitation has been confirmed via CISA KEV. EPSS indicates low exploitation probability (0.05%).

SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=delete_allowances. Public exploit code is available, but EPSS exploitation probability is low (0.05%) and no active exploitation (CISA KEV) is identified.

SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject SQL via the ID parameter in /ajax.php?action=delete_position. A publicly available exploit exists, and the vulnerability can be triggered with no authentication. The impact is limited to low-confidentiality, low-integrity, and low-availability effects per the assessed CVSS.