CWE-89

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpo

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Bas

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user

Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authe

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to exe

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, an

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The

Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of d

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator

FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnera

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several aut

SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directl

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL In

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion

Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset()

WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, WeGIA (Web gerenciador para instituições ass

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This v

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasourc

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wa

Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the sta

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metada

Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports v

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability ex

Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versi

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versi

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a cr

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost()

The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and '

A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve,

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated use

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated use

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, a

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifi

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifi

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike(

Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.