Total
17197 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-13572 | 1 Projectworlds | 1 Advanced Library Management System | 2025-12-02 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipulation of the argument admin_id leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. | |||||
| CVE-2025-13575 | 1 Fabian | 1 Blog Site | 2025-12-02 | 6.5 MEDIUM | 6.3 MEDIUM |
| A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php of the component Category Handler. Such manipulation of the argument name/field leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected. | |||||
| CVE-2025-13579 | 1 Code-projects | 1 Library System | 2025-12-02 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was found in code-projects Library System 1.0. This impacts an unknown function of the file /return.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. | |||||
| CVE-2025-13580 | 1 Code-projects | 1 Library System | 2025-12-02 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was determined in code-projects Library System 1.0. Affected is an unknown function of the file /mail.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2025-13582 | 1 Anisha | 1 Jonnys Liquor | 2025-12-02 | 7.5 HIGH | 7.3 HIGH |
| A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. | |||||
| CVE-2025-13583 | 1 Carmelo | 1 Question Paper Generator | 2025-12-02 | 7.5 HIGH | 7.3 HIGH |
| A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. | |||||
| CVE-2025-13586 | 1 Senior-walter | 1 Online Student Clearance System | 2025-12-02 | 5.8 MEDIUM | 4.7 MEDIUM |
| A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipulation of the argument txtconfirm_password causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. | |||||
| CVE-2025-63531 | 1 Shridharshukl | 1 Blood Bank Management System | 2025-12-02 | N/A | 10.0 CRITICAL |
| A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the remail and rpassword fields, an attacker can bypass authentication and gain unauthorized access to the system. | |||||
| CVE-2025-52664 | 1 Revive-adserver | 1 Revive Adserver | 2025-12-01 | N/A | 8.8 HIGH |
| SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users | |||||
| CVE-2025-13581 | 1 Facebook-julykringcadayona | 1 Student Information System | 2025-12-01 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was identified in itsourcecode Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /schedule_edit1.php. Such manipulation of the argument schedule_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. | |||||
| CVE-2025-13770 | 1 Uniong | 1 Webitr | 2025-12-01 | N/A | 6.5 MEDIUM |
| WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. | |||||
| CVE-2025-61167 | 1 Sigb | 1 Pmb | 2025-12-01 | N/A | 6.5 MEDIUM |
| SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id and datas parameters. | |||||
| CVE-2025-13769 | 1 Uniong | 1 Webitr | 2025-12-01 | N/A | 6.5 MEDIUM |
| WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. | |||||
| CVE-2025-66095 | 2025-11-28 | N/A | 4.3 MEDIUM | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13. | |||||
| CVE-2025-34245 | 1 Advantech | 1 Webaccess\/vpn | 2025-11-28 | N/A | 6.5 MEDIUM |
| Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. | |||||
| CVE-2025-34247 | 1 Advantech | 1 Webaccess\/vpn | 2025-11-28 | N/A | 6.5 MEDIUM |
| Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. | |||||
| CVE-2025-34246 | 1 Advantech | 1 Webaccess\/vpn | 2025-11-28 | N/A | 6.5 MEDIUM |
| Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. | |||||
| CVE-2025-34244 | 1 Advantech | 1 Webaccess\/vpn | 2025-11-28 | N/A | 6.5 MEDIUM |
| Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. | |||||
| CVE-2025-34243 | 1 Advantech | 1 Webaccess\/vpn | 2025-11-28 | N/A | 6.5 MEDIUM |
| Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. | |||||
| CVE-2025-34242 | 1 Advantech | 1 Webaccess\/vpn | 2025-11-28 | N/A | 6.5 MEDIUM |
| Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. | |||||