Base de CVEs

CVE-2025-0165 Crítica · 9.8 CWE-89 30/08/2025

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data SQL injection

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2025-54946 Crítica · 9.8 CWE-89 30/08/2025

SUNNET Corporate Training Management System - SQL Injection

A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands.

CVE-2025-9669 Crítica · 9.8 CWE-89 29/08/2025

Jinher OA GetTreeDate.aspx sql injection

A vulnerability has been found in Jinher OA 1.0. This issue affects some unknown processing of the file GetTreeDate.aspx. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

CVE-2025-9667 Alta · 8.8 CWE-89 29/08/2025

code-projects Simple Grading System Admin Panel delete_account.php sql injection

A vulnerability was detected in code-projects Simple Grading System 1.0. This affects an unknown part of the file /delete_account.php of the component Admin Panel. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

CVE-2025-9665 Alta · 8.8 CWE-89 29/08/2025

code-projects Simple Grading System Admin Panel edit_student.php sql injection

A weakness has been identified in code-projects Simple Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_student.php of the component Admin Panel. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

CVE-2025-29894 Alta · 8.8 CWE-89 29/08/2025

Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later

CVE-2025-29893 Alta · 8.8 CWE-89 29/08/2025

Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later

CVE-2025-9441 Média · 6.5 CWE-89 29/08/2025

iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter

The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2025-9610 Crítica · 9.8 CWE-89 29/08/2025

code-projects Online Event Judging System create_account.php sql injection

A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. This manipulation of the argument fname causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Other parameters might be affected as well.

CVE-2025-8858 Alta · 7.5 CWE-89 29/08/2025

Changing｜Clinic Image System - SQL Injection

Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

CVE-2025-57819 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-89 28/08/2025

Sangoma FreePBX Authentication Bypass Vulnerability

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

CVE-2025-49404 Alta · 8.5 CWE-89 28/08/2025

WordPress Listeo-Core Plugin < 2.0.7 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo Core listeo-core allows SQL Injection.This issue affects Listeo Core: from n/a through < 2.0.7.

CVE-2025-49402 Alta · 8.5 CWE-89 28/08/2025

WordPress Exertio Framework Plugin <= 1.3.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scriptsbundle Exertio Framework exertio-framework allows Blind SQL Injection.This issue affects Exertio Framework: from n/a through <= 1.3.3.

CVE-2025-39496 Crítica · 9.3 CWE-89 28/08/2025

WordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6.

CVE-2025-25257 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-89 17/07/2025

Fortinet FortiWeb SQL Injection Vulnerability

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

CVE-2025-25513 Crítica · 9.8 CWE-89 24/02/2025

Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.

CVE-2024-32838 Alta · 8.8 CWE-89 12/02/2025

Apache Fineract: SQL injection vulnerabilities in offices API endpoint

SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter. Users are recommended to upgrade to version 1.10.1, which fixes this issue. A SQL Validator has been implemented which allows us to configure a series of tests and checks against our SQL queries that will allow us to validate and protect against nearly all potential SQL injection attacks.

CVE-2025-25181 Alta · 7.5 KEV Alta · 59 CWE-89 03/02/2025

Advantive VeraCore SQL Injection Vulnerability

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

CVE-2024-9465 Crítica · 9.1 KEV Urgente · 73 Exploit público CWE-89 09/10/2024

Palo Alto Networks Expedition SQL Injection Vulnerability

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.

CVE-2024-43468 Crítica · 9.8 KEV Alta · 69 Exploit público CWE-89 08/10/2024

Microsoft Configuration Manager SQL Injection Vulnerability

Microsoft Configuration Manager Remote Code Execution Vulnerability

CVE-2024-9379 Alta · 7.2 KEV Alta · 56 CWE-89 08/10/2024

Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

CVE-2024-6670 Crítica · 9.8 KEV Urgente · 90 Exploit público Ransomware CWE-89 29/08/2024

Progress WhatsUp Gold SQL Injection Vulnerability

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

CVE-2024-29824 Alta · 8.8 KEV Urgente · 79 Exploit público CWE-89 31/05/2024

Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

CVE-2023-48788 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware CWE-89 12/03/2024

Fortinet FortiClient EMS SQL Injection Vulnerability

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.

CVE-2023-46748 Alta · 8.8 KEV Alta · 55 CWE-89 26/10/2023

F5 BIG-IP Configuration Utility SQL Injection Vulnerability

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated