Filtered by CWE-89
Filtered by vendor Subscriptions
Total 18623 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-24684 1 Churchcrm 1 Churchcrm 2025-03-24 7.2 High
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.
CVE-2023-0758 1 Jfinaloa Project 1 Jfinaloa 2025-03-24 6.3 Medium
A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability.
CVE-2022-4557 1 Gruparge 1 Smartpower 2025-03-24 9.8 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection.This issue affects Smartpower Web: before 23.01.01.
CVE-2024-57031 1 Wegia 1 Wegia 2025-03-24 9.8 Critical
WeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the id_funcionario parameter.
CVE-2025-2684 1 Phpgurukul 1 Bank Locker Management System 2025-03-24 7.3 High
A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. This issue affects some unknown processing of the file /search-report-details.php. The manipulation of the argument searchinput leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-0771 1 Ampache 1 Ampache 2025-03-24 8.8 High
SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.
CVE-2021-25069 1 W3eden 1 Download Manager 2025-03-21 8.8 High
The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
CVE-2023-24084 1 Chikoi Project 1 Chikoi 2025-03-21 9.8 Critical
ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load_file function.
CVE-2022-45962 1 Os4ed 1 Opensis 2025-03-21 6.5 Medium
Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php.
CVE-2022-4546 1 Conceptbeans 1 Mapwiz 2025-03-21 7.2 High
The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVE-2025-24974 1 Dataease 1 Dataease 2025-03-21 6.5 Medium
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
CVE-2025-2585 2025-03-21 8.8 High
EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.
CVE-2024-41767 3 Ibm, Linux, Microsoft 4 Engineering Lifecycle Optimization - Publishing, Engineering Lifecycle Optimization Publishing, Linux Kernel and 1 more 2025-03-21 7.3 High
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2024-54920 1 Lopalopa 1 E-learning Management System 2025-03-21 9.8 Critical
A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the firstname, lastname, and class_id parameters.
CVE-2024-42573 2 Arajajyothibabu, School Management System Project 2 School Management System, School Management System 2025-03-21 9.8 Critical
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php.
CVE-2024-31506 2 Online Graduate Tracer System Project, Tamparongj03 2 Online Graduate Tracer System, Online Graduate Tracer System 2025-03-20 4.9 Medium
Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admin_cs.php.
CVE-2024-12016 2025-03-20 9.8 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CM Informatics CM News allows SQL Injection.This issue affects CM News: through 6.0. NOTE: The vendor was contacted and it was learned that the product is not supported.
CVE-2021-38239 1 Dataease 1 Dataease 2025-03-20 7.5 High
SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.
CVE-2021-34117 1 Seopanel 1 Seo Panel 2025-03-20 7.5 High
SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, allows attackers to gain sensitive information.
CVE-2021-33925 1 Cms-corephp Project 1 Cms-corephp 2025-03-20 9.8 Critical
SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows unauthenticated attackers to gain escilated privledges via a crafted login.