Total
20784 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-51667 | 1 Ryansu | 1 Simple Admin | 2026-06-17 | N/A | 7.0 HIGH |
| An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7. The /sys-api/role/update interface in the simple-admin-core system has a limited SQL injection vulnerability, which may lead to partial data leakage or disruption of normal system operations. | |||||
| CVE-2025-51626 | 1 Xiaoliuchu | 1 Pss.sale.com | 2026-06-17 | N/A | 6.5 MEDIUM |
| SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel_order.php endpoint. | |||||
| CVE-2025-51567 | 1 Jayesh | 1 Online Exam System | 2026-06-17 | N/A | 9.1 CRITICAL |
| A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the rname, rcollage, rnumber, rgender and rpassword parameters in a POST HTTP request. | |||||
| CVE-2025-51510 | 1 Getmoonshine | 1 Moonshine | 2026-06-17 | N/A | 4.9 MEDIUM |
| MoonShine was discovered to contain a SQL injection vulnerability under the Blog -> Categories page when using the moonshine-tree-resource (version < 2.0.2) component. | |||||
| CVE-2025-51506 | 1 Talentneuron | 1 Hrforecast Suite | 2026-06-17 | N/A | 6.5 MEDIUM |
| In the smartLibrary component of the HRForecast Suite 0.4.3, a SQL injection vulnerability was discovered in the valueKey parameter. This flaw enables any authenticated user to execute arbitrary SQL queries, via crafted payloads to valueKey to the api/smartlibrary/v2/en/dictionaries/options/lookup endpoint. | |||||
| CVE-2025-51458 | 1 Dbgpt | 1 Db-gpt | 2026-06-17 | N/A | 6.5 MEDIUM |
| SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sql/run or /v1/editor/chart/run endpoints, interacting with api_editor_v1.editor_sql_run, editor_chart_run, and datasource.rdbms.base.query_ex. | |||||
| CVE-2025-51092 | 1 Vishnusivadas | 1 Login-signup | 2026-06-17 | N/A | 9.8 CRITICAL |
| The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and signUp() build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareData() function exists, it is insufficient to prevent SQL injection and does not sanitize the table name. | |||||
| CVE-2025-51045 | 1 Phpgurukul | 1 Pre-school Enrollment System | 2026-06-17 | N/A | 6.5 MEDIUM |
| Phpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerability is attributed to the insufficient validation of user input for the username parameter. | |||||
| CVE-2025-51044 | 1 Phpgurukul | 1 Nipah Virus Testing Management System | 2026-06-17 | N/A | 6.5 MEDIUM |
| phpgurukul Nipah virus (NiV) Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to insufficient validation of user input for the " govtissuedid" parameter. | |||||
| CVE-2025-50984 | 1 Diskoverdata | 1 Diskover | 2026-06-17 | N/A | 5.3 MEDIUM |
| diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration form. Unsanitized user input in POST parameters such as ES_PASS, ES_MAXSIZE, ES_TRANSLOGSIZE, ES_TIMEOUT, ES_USER, ES_HOST, ES_PORT, ES_SCROLLSIZE, ES_CHUNKSIZE and others can be crafted to inject arbitrary SQLite expressions wrapped in JSON functions. By exploiting these injection points, an attacker can infer or extract sensitive information from the underlying database without authentication. This issue stems from improper input validation and parameterization in the application's JSON-based query construction. | |||||
| CVE-2025-50983 | 1 Readarr | 1 Readarr | 2026-06-17 | N/A | 8.3 HIGH |
| SQL Injection vulnerability exists in the sortKey parameter of the GET /api/v1/wanted/cutoff API endpoint in readarr 0.4.15.2787. The endpoint fails to properly sanitize user-supplied input, allowing attackers to inject and execute arbitrary SQL commands against the backend SQLite database. Sqlmap confirmed exploitation via stacked queries, demonstrating that the parameter can be abused to run arbitrary SQL statements. A heavy query was executed using SQLite's RANDOMBLOB() and HEX() functions to simulate a time-based payload, indicating deep control over database interactions. | |||||
| CVE-2025-50979 | 1 Nodebb | 1 Nodebb | 2026-06-17 | N/A | 8.6 HIGH |
| NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads. | |||||
| CVE-2025-50972 | 1 Abantecart | 1 Abantecart | 2026-06-17 | N/A | 9.8 CRITICAL |
| SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Three techniques have been demonstrated: error-based injection using a crafted FLOOR-based payload, time-based blind injection via SLEEP(), and UNION-based injection to extract arbitrary data. | |||||
| CVE-2025-50928 | 1 Ehcp | 1 Easy Hosting Control Panel | 2026-06-17 | N/A | 4.8 MEDIUM |
| Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settings function. | |||||
| CVE-2025-50926 | 1 Ehcp | 1 Easy Hosting Control Panel | 2026-06-17 | N/A | 6.5 MEDIUM |
| Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the List All Email Addresses function. | |||||
| CVE-2025-50868 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before being used in SQL queries. | |||||
| CVE-2025-50867 | 1 Vishalmathur | 1 Cloudclassroom | 2026-06-17 | N/A | 6.5 MEDIUM |
| A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedded in SQL statements without sanitization. | |||||
| CVE-2025-50860 | 1 Ehcp | 1 Easy Hosting Control Panel | 2026-06-17 | N/A | 5.4 MEDIUM |
| SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter. | |||||
| CVE-2025-50565 | 1 Doubo Erp Project | 1 Doubo Erp | 2026-06-17 | N/A | 6.5 MEDIUM |
| Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. | |||||
| CVE-2025-50468 | 1 Open-metadata | 1 Openmetadata | 2026-06-17 | N/A | 6.5 MEDIUM |
| OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the DocStoreDAO interface. The entityType parameters can be used to build a SQL query. | |||||