Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2025-11106
Critical · 9.8
CWE-74 Sep 28, 2025
code-projects Simple Scheduling System addfaculty.php sql injection
A vulnerability has been found in code-projects Simple Scheduling System 1.0. This vulnerability affects unknown code of the file /schedulingsystem/addfaculty.php. Such manipulation of the argument falname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-11105
Critical · 9.8
CWE-74 Sep 28, 2025
code-projects Simple Scheduling System addsubject.php sql injection
A flaw has been found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /schedulingsystem/addsubject.php. This manipulation of the argument subcode causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2025-11104
High · 8.8
CWE-74 Sep 28, 2025
CodeAstro Electricity Billing System bill.php sql injection
A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /admin/bill.php. The manipulation of the argument uid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2025-11102
Critical · 9.8
CWE-74 Sep 28, 2025
Campcodes Online Learning Management System edit_content.php sql injection
A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/edit_content.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-11101
Critical · 9.8
CWE-74 Sep 28, 2025
itsourcecode Open Source Job Portal index.php sql injection
A security flaw has been discovered in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/company/index.php?view=edit. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
CVE-2025-11100
High · 8.8
CWE-74 Sep 28, 2025
D-Link DIR-823X set_wifi_blacklists uci_set command injection
A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVE-2025-11099
High · 8.8
CWE-74 Sep 28, 2025
D-Link DIR-823X delete_prohibiting uci_del command injection
A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-11098
High · 8.8
CWE-74 Sep 28, 2025
D-Link DIR-823X set_wifi_blacklists command injection
A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of the argument macList results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVE-2025-11097
High · 8.8
CWE-74 Sep 28, 2025
D-Link DIR-823X set_device_name command injection
A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-11096
High · 8.8
CWE-74 Sep 28, 2025
D-Link DIR-823X diag_traceroute command injection
A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.
CVE-2025-11095
High · 8.8
CWE-74 Sep 28, 2025
D-Link DIR-823X delete_offline_device command injection
A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulation of the argument delvalue results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVE-2025-11094
Critical · 9.8
CWE-74 Sep 28, 2025
code-projects E-Commerce Website admin_product_details.php sql injection
A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/admin_product_details.php. Such manipulation of the argument prod_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-11092
High · 8.8
CWE-74 Sep 28, 2025
D-Link DIR-823X set_switch_settings sub_412E7C command injection
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-11090
High · 8.8
CWE-74 Sep 27, 2025
itsourcecode Open Source Job Portal index.php sql injection
A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected is an unknown function of the file /admin/employee/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVE-2025-11089
Critical · 9.8
CWE-74 Sep 27, 2025
kidaze CourseSelectionSystem COUNT3s4.php sql injection
A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This impacts an unknown function of the file /Profilers/PriProfile/COUNT3s4.php. Executing manipulation of the argument cbranch can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVE-2025-11088
High · 8.8
CWE-74 Sep 27, 2025
itsourcecode Open Source Job Portal index.php sql injection
A weakness has been identified in itsourcecode Open Source Job Portal 1.0. Impacted is an unknown function of the file /admin/vacancy/index.php?view=edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVE-2025-11077
Critical · 9.8
CWE-74 Sep 27, 2025
Campcodes Online Learning Management System add_content.php sql injection
A vulnerability was determined in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/add_content.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-11076
Critical · 9.8
CWE-74 Sep 27, 2025
Campcodes Online Learning Management System edit_teacher.php sql injection
A vulnerability was found in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_teacher.php. Performing manipulation of the argument department results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2025-11075
Critical · 9.8
CWE-74 Sep 27, 2025
Campcodes Online Learning Management System de_activate.php sql injection
A vulnerability has been found in Campcodes Online Learning Management System 1.0. This affects an unknown function of the file /admin/de_activate.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-11074
Critical · 9.8
CWE-74 Sep 27, 2025
code-projects Project Monitoring System login.php sql injection
A flaw has been found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument username/password causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVE-2025-11071
High · 7.2
CWE-74 Sep 27, 2025
SeaCMS Cron Task Management admin_cron.php sql injection
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-11073
Medium · 4.7
CWE-74 Sep 27, 2025
Keyfactor RG-EW5100BE HTTP POST Request cmd command injection
A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the argument url results in command injection. The attack can be launched remotely. The exploit is now public and may be used.
CVE-2025-11070
Critical · 9.8
CWE-74 Sep 27, 2025
Projectworlds Online Shopping System cart_add.php sql injection
A vulnerability was identified in Projectworlds Online Shopping System 1.0. This affects an unknown part of the file /store/cart_add.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVE-2025-11066
Critical · 9.8
CWE-74 Sep 27, 2025
code-projects Online Bidding System bidlist.php sql injection
A flaw has been found in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/bidlist.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVE-2025-11064
Critical · 9.8
CWE-74 Sep 27, 2025
Campcodes Online Learning Management System teachers.php sql injection
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Impacted is an unknown function of the file /admin/teachers.php. The manipulation of the argument department results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.