CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

3.751 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-26707 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Oretnom23 Pharmacy Point Of Sale System
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php.
CVE-2026-26706 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Oretnom23 Pharmacy Point Of Sale System
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php.
CVE-2026-26705 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Oretnom23 Pharmacy Point Of Sale System
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php.
CVE-2026-26704 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Oretnom23 Pharmacy Point Of Sale System
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php.
CVE-2026-28399 High · 8.8 CWE-89 Mar 2, 2026
NocoDB: SQL Injection via DATEADD Formula
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
CVE-2026-26708 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Oretnom23 Pharmacy Point Of Sale System
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.
CVE-2026-26700 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Jon-remus-sevellejo Personnel Property Equipment System
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.
CVE-2026-26701 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Jon-remus-sevellejo Personnel Property Equipment System
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.
CVE-2026-26703 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Jon-remus-sevellejo Personnel Property Equipment System
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/advance_search.php.
CVE-2026-26702 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Jon-remus-sevellejo Personnel Property Equipment System
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/myitem_reuse.php.
CVE-2026-26696 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Carmelo Simple Student Alumni System
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php.
CVE-2026-26695 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Carmelo Simple Student Alumni System
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php.
CVE-2026-26694 Critical · 9.8 CWE-89 Mar 2, 2026
SQL Injection in Carmelo Simple Student Alumni System
code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php.
CVE-2025-50192 Critical · 9.8 CWE-89 Mar 2, 2026
Chamilo: Time-based SQL Injection in /main/webservices/registration.soap.php
Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30.
CVE-2025-50191 High · 7.2 CWE-89 Mar 2, 2026
Chamilo: Error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script
Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30.
CVE-2025-50190 Critical · 9.8 CWE-89 Mar 2, 2026
Chamilo: Error-based SQL Injection via GET openid.assoc_handle with the /index.php script
Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30.
CVE-2025-50189 High · 8.8 CWE-89 Mar 2, 2026
Chamilo: Error-based SQL Injection
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.
CVE-2025-50188 High · 7.2 CWE-89 Mar 2, 2026
Error-based SQL Injection in Chamilo LMS
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.
CVE-2026-26698 Medium · 4.9 CWE-89 Mar 2, 2026
SQL Injection in Carmelo Simple Student Alumni System
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php.
CVE-2026-26697 Medium · 4.9 CWE-89 Mar 2, 2026
SQL Injection in Carmelo Simple Student Alumni System
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?teacherID=.
CVE-2025-12462 Critical · 9.3 CWE-89 Mar 2, 2026
Blind SQL Injection in DobryCMS
A Blind SQL injection vulnerability has been identified in DobryCMS.  A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple parameters resulting in Blind SQL Injection. This issue was fixed in versions above 8.0.
CVE-2025-30062 Medium · 6.9 CWE-89 Mar 2, 2026
SQL injection in CheckUnitCodeAndKey.pl
In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.
CVE-2025-10350 High · 8.8 CWE-89 Mar 2, 2026
SQL injection in CGM NETRAAD
SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to database, including data processed by GCM CLININET software.This issue affects CGM NETRAAD with imageserver module in versions before 7.9.0.
CVE-2026-2584 Critical · 9.3 CWE-89 Mar 2, 2026
SQL Injection in Ciser System SL firmware
A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker (AV:N/PR:N) can exploit this flaw by sending specially crafted SQL queries through the login interface. Due to low attack complexity (AC:L) and the absence of specific requirements (AT:N), the vulnerability allows for a total compromise of the system's configuration data (VC:H/VI:H). While the availability of the service remains unaffected (VA:N), the breach may lead to a limited exposure of sensitive information regarding subsequent or interconnected systems (SC:L).
CVE-2026-3413 Critical · 9.8 CWE-89 Mar 2, 2026
itsourcecode University Management System admin_single_student.php sql injection
A flaw has been found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /admin_single_student.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.