CVE-2025-10394

fcba_zzm ics-park Smart Park Management System Scheduled Task JobController.java code injection

A vulnerability has been found in fcba_zzm ics-park Smart Park Management System 2.0. Affected is an unknown function of the file ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/JobController.java of the component Scheduled Task Module. Such manipulation leads to code injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Fcba Zzm

Products

Smart Park Management System

CVE-2025-11516

code-projects Online Complaint Site complaint-details.php sql injection

A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Executing manipulation of the argument cid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

Online Complaint Site Online Complaint Site

CVE-2025-11342

code-projects Online Course Registration edit-course.php sql injection

A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the file /admin/edit-course.php. Executing manipulation of the argument coursecode can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

Online Course Registration Online Course Registration Site

CVE-2025-11343

code-projects Student Crud Operation delete.php sql injection

A security vulnerability has been detected in code-projects Student Crud Operation 3.3. Affected is an unknown function of the file delete.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Crud Operation System Student Crud Operation

CVE-2025-11511

code-projects E-Commerce Website supplier_add.php sql injection

A flaw has been found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/supplier_add.php. Executing manipulation of the argument supp_email can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

E-commerce Website E-commerce Website

CVE-2025-11509

code-projects E-Commerce Website product_add.php sql injection

A vulnerability was detected in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/product_add.php. Performing manipulation of the argument prod_name results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

E-commerce Website E-commerce Website

CVE-2025-8220

Engeman Web Password Recovery RecoveryPass sql injection

A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 12.0.0.3 is sufficient to fix this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Engeman

Products

Web

CVE-2025-2036

s-a-zhd Ecommerce-Website-using-PHP details.php sql injection

A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0. It has been classified as critical. This affects an unknown part of the file details.php. The manipulation of the argument pro_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

S-a-zhd

Products

Ecommerce-website-using-php

CVE-2025-2041

s-a-zhd Ecommerce-Website-using-PHP shop.php sql injection

A vulnerability, which was classified as critical, has been found in s-a-zhd Ecommerce-Website-using-PHP 1.0. Affected by this issue is some unknown functionality of the file /shop.php. The manipulation of the argument p_cat leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

S-a-zhd

Products

Ecommerce-website-using-php

CVE-2025-0698

JoeyBling bootplus list sql injection

A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been classified as critical. Affected is an unknown function of the file /admin/sys/menu/list. The manipulation of the argument sort/order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Joeybling

Products

Bootplus

CVE-2025-0699

JoeyBling bootplus list sql injection

A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sys/role/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Joeybling

Products

Bootplus

CVE-2025-0700

JoeyBling bootplus list sql injection

A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/sys/log/list. The manipulation of the argument logId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Joeybling

Products

Bootplus

CVE-2025-0701

JoeyBling bootplus list sql injection

A vulnerability classified as critical has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This affects an unknown part of the file /admin/sys/user/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Joeybling

Products

Bootplus

CVE-2025-11071

SeaCMS Cron Task Management admin_cron.php sql injection

A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Seacms

Products

Seacms

CVE-2025-3553

phpshe admin.php pe_delete sql injection

A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /admin.php?mod=brand&act=del. The manipulation of the argument brand_id[] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpshe

Products

Phpshe

CVE-2025-3559

ghostxbh uzy-ssm-mall 20 ForeProductListController sql injection

A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ghostxbh

Products

Uzy-ssm-mall

CVE-2025-3369

xxyopen Novel-Plus list sql injection

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/friendLink/list. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xxyopen

Products

Novel-plus

CVE-2025-11515

code-projects Online Complaint Site register-complaint.php sql injection

A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-complaint.php. Performing manipulation of the argument cid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

Online Complaint Site Online Complaint Site

CVE-2025-11513

code-projects E-Commerce Website supplier_update.php sql injection

A vulnerability was determined in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/supplier_update.php. This manipulation of the argument supp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

E-commerce Website E-commerce Website

CVE-2025-11514

code-projects Online Complaint Site index.php sql injection

A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

Online Complaint Site Online Complaint Site