Search Results (17776 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-41771 1 Phoenix Contact 17 Axc F 1152 Firmware, Axc F 1252 Firmware, Axc F 2000 Ea Firmware and 14 more 2026-08-12 4.3 Medium
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.
CVE-2026-2057 2 Bontrofftech, Sourcecodester 2 Medical Center Portal Management System, Medical Center Portal Management System 2026-02-10 7.3 High
A vulnerability was detected in SourceCodester Medical Center Portal Management System 1.0. This affects an unknown function of the file /login.php. The manipulation of the argument User results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
CVE-2026-25993 2026-02-10 N/A
EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.
CVE-2026-25947 2026-02-10 8.8 High
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
CVE-2025-62392 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62391 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62390 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62389 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62388 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62387 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62386 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62385 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62384 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62383 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-61548 1 Edubusinesssolutions 1 Print Shop Pro Webdesk 2026-02-10 9.8 Critical
SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping. This vulnerability allows remote attackers to execute arbitrary SQL commands
CVE-2025-11623 1 Ivanti 1 Endpoint Manager 2026-02-10 6.5 Medium
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2026-2018 1 Itsourcecode 1 School Management System 2026-02-10 7.3 High
A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVE-2026-2014 1 Itsourcecode 2 School Management System, Student Management System 2026-02-10 7.3 High
A security flaw has been discovered in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /ramonsys/billing/index.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVE-2026-2013 1 Itsourcecode 2 School Management System, Student Management System 2026-02-10 7.3 High
A vulnerability was identified in itsourcecode Student Management System 1.0. This affects an unknown function of the file /ramonsys/soa/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVE-2026-2012 1 Itsourcecode 2 School Management System, Student Management System 2026-02-10 7.3 High
A vulnerability was determined in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /ramonsys/facultyloading/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.