Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-36945
Low · 2.7
CWE-89 Apr 13, 2026
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to…
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php
CVE-2026-36944
Low · 2.7
CWE-89 Apr 13, 2026
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to…
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php.
CVE-2026-36943
Low · 2.7
CWE-89 Apr 13, 2026
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to…
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php.
CVE-2026-36942
Low · 2.7
CWE-89 Apr 13, 2026
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in…
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php.
CVE-2026-36941
Low · 2.7
CWE-89 Apr 13, 2026
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in…
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php.
CVE-2026-36947
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Oretnom23 Computer And Mobile Repair Shop Management System
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_service.php.
CVE-2026-36946
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Oretnom23 Computer And Mobile Repair Shop Management System
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php.
CVE-2026-36923
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Oretnom23 Cab Management System
Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php.
CVE-2026-36922
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Oretnom23 Cab Management System
Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php.
CVE-2026-36920
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Janobe Online Reviewer System
Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions-view.php.
CVE-2026-36919
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Janobe Online Reviewer System
Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-update.php.
CVE-2026-36874
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Razormist Basic Library System
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php.
CVE-2026-36873
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Razormist Basic Library System
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php.
CVE-2026-36872
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Razormist Basic Library System
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php.
CVE-2026-3830
High · 8.6
CWE-89 Apr 13, 2026
Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
CVE-2025-15441
Medium · 6.8
CWE-89 Apr 13, 2026
Form Maker < 1.15.38 - SQL Injection
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.
CVE-2019-25713
High · 8.1
CWE-89 Apr 12, 2026
MyT-PM 1.5.1 SQL Injection via Charge[group_total] Parameter
MyT-PM 1.5.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the Charge[group_total] parameter. Attackers can submit crafted POST requests to the /charge/admin endpoint with error-based, time-based blind, or stacked query payloads to extract sensitive database information or manipulate data.
CVE-2019-25710
Critical · 9.1
CWE-89 Apr 12, 2026
Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter
Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques.
CVE-2019-25707
High · 7.1
CWE-89 Apr 12, 2026
eBrigade ERP 4.5 SQL Injection via pdf.php
eBrigade ERP 4.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to pdf.php with crafted SQL payloads in the 'id' parameter to extract sensitive database information including table names and schema details.
CVE-2019-25703
High · 8.8
CWE-89 Apr 12, 2026
ImpressCMS 1.3.11 SQL Injection via bid Parameter
ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'bid' parameter. Attackers can send POST requests to the admin.php endpoint with malicious 'bid' values containing SQL commands to extract sensitive database information.
CVE-2019-25699
High · 7.1
CWE-89 Apr 12, 2026
Newsbull Haber Script 1.0.0 Authenticated SQL Injection via search parameter
Newsbull Haber Script 1.0.0 contains multiple SQL injection vulnerabilities in the search parameter that allow authenticated attackers to extract database information through time-based, blind, and boolean-based injection techniques. Attackers can inject malicious SQL code through the search parameter in endpoints like /admin/comment/records, /admin/category/records, /admin/news/records, and /admin/menu/childs to manipulate database queries and retrieve sensitive data.
CVE-2019-25697
Critical · 9.8
CWE-89 Apr 12, 2026
CMSsite 1.0 SQL Injection via category.php
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cat_id parameter. Attackers can send GET requests to category.php with malicious cat_id values to extract sensitive database information including usernames and credentials.
CVE-2019-25693
High · 7.1
CWE-89 Apr 12, 2026
ResourceSpace 8.6 SQL Injection via collection_edit.php
ResourceSpace 8.6 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keywords parameter in collection_edit.php. Attackers can submit POST requests with crafted SQL payloads in the keywords field to extract sensitive database information including schema names, user credentials, and other confidential data.
CVE-2018-25257
High · 7.1
CWE-89 Apr 12, 2026
Adianti Framework 5.5.0 and 5.6.0 SQL Injection via Profile
Adianti Framework 5.5.0 and 5.6.0 contains an SQL injection vulnerability that allows authenticated users to manipulate database queries by injecting SQL code through the name field in SystemProfileForm. Attackers can submit crafted SQL statements in the profile edit endpoint to modify user credentials and gain administrative access.
CVE-2026-5207
Medium · 6.5
CWE-89 Apr 10, 2026
LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter
The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level access and above who have the edit_post capability on the quiz, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.