Filtered by CWE-89
Filtered by vendor Subscriptions
Total 16933 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-10762 1 Dootask 1 Dootask 2025-09-23 6.3 Medium
A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/UsersController.php. The manipulation of the argument keys[department] results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVE-2025-10002 2 Flowdee, Wordpress 2 Clickwhale, Wordpress 2025-09-23 4.9 Medium
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted.
CVE-2025-10652 1 Wordpress 1 Wordpress 2025-09-23 6.5 Medium
The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-10483 2 Janobe, Sourcecodester 2 Online Student File Management System, Online Student File Management System 2025-09-22 6.3 Medium
A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/save_user.php. This manipulation of the argument firstname causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. Other parameters might be affected as well.
CVE-2025-10482 2 Janobe, Sourcecodester 2 Online Student File Management System, Online Student File Management System 2025-09-22 7.3 High
A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
CVE-2025-10481 2 Janobe, Sourcecodester 2 Online Student File Management System, Online Student File Management System 2025-09-22 6.3 Medium
A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of the file /remove_file.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2025-10602 3 Janobe, Online Exam Form Submission Project, Sourcecodester 3 Online Exam Form Submission, Online Exam Form Submission, Online Exam Form Submission 2025-09-22 6.3 Medium
A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s1.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVE-2025-10563 1 Campcodes 1 Grocery Sales And Inventory System 2025-09-22 7.3 High
A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_category. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-10592 2 Carenlove, Itsourcecode 2 Online Public Access Catalog, Online Public Access Catalog Opac 2025-09-22 6.3 Medium
A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of the component POST Parameter Handler. Such manipulation of the argument search_field/search_text leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVE-2025-10595 2 Janobe, Sourcecodester 2 Online Student File Management System, Online Student File Management System 2025-09-22 6.3 Medium
A vulnerability has been found in SourceCodester Online Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/delete_user.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-10596 3 Janobe, Online Exam Form Submission Project, Sourcecodester 3 Online Exam Form Submission, Online Exam Form Submission, Online Exam Form Submission 2025-09-22 7.3 High
A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument usn results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2025-10598 2 Mayurik, Sourcecodester 2 Pet Grooming Management Software, Pet Grooming Management Software 2025-09-22 7.3 High
A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This issue affects some unknown processing of the file /admin/search_product.php. Such manipulation of the argument group_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVE-2025-10599 1 Itsourcecode 1 Web-based Internet Laboratory Management System 2025-09-22 7.3 High
A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the file login.php. Performing manipulation of the argument user_email results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVE-2025-10601 3 Janobe, Online Exam Form Submission Project, Sourcecodester 3 Online Exam Form Submission, Online Exam Form Submission, Online Exam Form Submission 2025-09-22 7.3 High
A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. Affected is an unknown function of the file /admin/index.php. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-10712 1 07fly 3 07fly-cms, 07flycms, 07flycrm 2025-09-22 7.3 High
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.php/Login/login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-29892 1 Qnap 1 Qsync Central 2025-09-20 8.8 High
An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.6 ( 2025/03/20 ) and later
CVE-2025-44034 1 Aaluoxiang 1 Oasys 2025-09-20 8.0 High
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AddrController
CVE-2025-52044 1 Frappe 1 Erpnext 2025-09-20 7.5 High
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventory_dimensions_dict parameter.
CVE-2025-52048 1 Frappe 1 Frappe 2025-09-20 6.5 Medium
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker to extract information from databases by injecting a SQL query into the `dt` parameter.
CVE-2025-10436 1 Campcodes 1 Computer Sales And Inventory System 2025-09-20 7.3 High
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/sup_searchfrm.php?action=edit. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.