Filtered by CWE-89
Filtered by vendor Subscriptions
Total 16947 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-9756 1 Phpgurukul 1 User Management System 2025-09-08 6.3 Medium
A vulnerability was found in PHPGurukul User Management System 1.0. This impacts an unknown function of the file /admin/change-emailid.php. The manipulation of the argument uid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVE-2025-9757 2 Campcodes, Sourcecodester 2 Courier Management System, Courier Management System 2025-09-08 7.3 High
A vulnerability was determined in Campcodes/SourceCodester Courier Management System 1.0. Affected is the function Login of the file /ajax.php. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-9759 2 Campcodes, Sourcecodester 2 Courier Management System, Courier Management System 2025-09-08 7.3 High
A security flaw has been discovered in Campcodes/SourceCodester Courier Management System 1.0. Affected by this issue is the function Signup of the file /ajax.php. Performing manipulation of the argument lastname results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVE-2025-9766 2 Angeljudesuarez, Itsourcecode 2 Sports Management System, Sports Management System 2025-09-08 7.3 High
A vulnerability was found in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/facilitator.php. Performing manipulation of the argument code results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2025-9761 1 Campcodes 1 Online Feeds Product Inventory System 2025-09-08 7.3 High
A security vulnerability has been detected in Campcodes Online Feeds Product Inventory System 1.0. This vulnerability affects unknown code of the file /feeds/index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-9763 1 Campcodes 1 Online Learning Management System 2025-09-08 7.3 High
A vulnerability was detected in Campcodes Online Learning Management System 1.0. This issue affects some unknown processing of the file /student_signup.php. The manipulation of the argument Username results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
CVE-2025-9764 2 Angeljudesuarez, Itsourcecode 2 Sports Management System, Sports Management System 2025-09-08 7.3 High
A flaw has been found in itsourcecode Sports Management System 1.0. Impacted is an unknown function of the file /Admin/resultdetails.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVE-2025-9765 2 Angeljudesuarez, Itsourcecode 2 Sports Management System, Sports Management System 2025-09-08 7.3 High
A vulnerability has been found in itsourcecode Sports Management System 1.0. The affected element is an unknown function of the file /Admin/tournament_details.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-58628 1 Wordpress 1 Wordpress 2025-09-07 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous allows Blind SQL Injection. This issue affects Miraculous: from n/a through n/a.
CVE-2025-48544 1 Google 1 Android 2025-09-05 7.8 High
In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-50565 1 Doubo Erp Project 1 Doubo Erp 2025-09-05 6.5 Medium
Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker.
CVE-2022-42122 1 Liferay 2 Dxp, Liferay Portal 2025-09-05 9.8 Critical
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
CVE-2022-42121 1 Liferay 3 Digital Experience Platform, Dxp, Liferay Portal 2025-09-05 8.8 High
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
CVE-2022-42120 1 Liferay 2 Dxp, Liferay Portal 2025-09-05 9.8 Critical
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
CVE-2025-55476 1 Shaneisrael 1 Fireshare 2025-09-05 6.5 Medium
FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/public?sort= This parameter is unsafely evaluated in a SQL ORDER BY clause without proper sanitization, allowing an attacker to inject arbitrary SQL subqueries.
CVE-2025-9829 1 Phpgurukul 1 Beauty Parlour Management System 2025-09-05 7.3 High
A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /signup.php. The manipulation of the argument mobilenumber leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Other parameters might be affected as well.
CVE-2025-9830 1 Phpgurukul 1 Beauty Parlour Management System 2025-09-05 7.3 High
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids[] results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
CVE-2025-9767 2 Angeljudesuarez, Itsourcecode 2 Sports Management System, Sports Management System 2025-09-05 7.3 High
A vulnerability was determined in itsourcecode Sports Management System 1.0. This affects an unknown function of the file /Admin/sporttype.php. Executing manipulation of the argument code can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-9831 1 Phpgurukul 1 Beauty Parlour Management System 2025-09-05 7.3 High
A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This manipulation of the argument sername causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-9832 2 Oretnom23, Sourcecodester 2 Food Ordering Management System, Food Ordering Management System 2025-09-05 7.3 High
A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file /routers/register-router.php. Such manipulation of the argument phone leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.