CVE-2023-5807

SQLi in TRtek Software's Education Portal

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection. This issue affects Education Portal: before 3.2023.29.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Trek Software Trteksolutions

Products

Education Portal Education Portal

CVE-2023-5806

SQLi in Mergen Soft Quality Management System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Injection. This issue affects Quality Management System: before v1.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mergentech

Products

Quality Management System

CVE-2023-6145

SQLi in Softomi E-commerce Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Advanced C2C Marketplace Software allows SQL Injection. This issue affects Softomi Advanced C2C Marketplace Software: before 12122023.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Softomi

Products

Advanced C2c Marketplace Software

CVE-2026-9010

Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters

The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pixelyoursite Wordpress

Products

Boost Wordpress

CVE-2026-9003

TONNET｜E-LAN Hybrid Recording System - SQL Injection

E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tonnet

Products

Tpr7308

CVE-2023-6191

SQLi in WebPDKS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egehan Security WebPDKS allows SQL Injection. This issue affects WebPDKS: through 20240329. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Webpdks

Products

Egehan Security Webpdks

CVE-2023-6173

SQLi in TeoSOFT Software TeoBASE

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeoSOFT Software TeoBASE allows SQL Injection. This issue affects TeoBASE: through 27032024. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2023-5155

SQLi in Utarit's Smart Deposit System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection. This issue affects SoliPay Mobile App: before 5.0.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Utarit

Products

Solipay Mobile Solipay Mobile App

CVE-2023-6436

SQLi in Ekol Bilisim Website Template

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. This issue affects Website Template: through 20231215.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ekolbilisim

Products

Web Sablonu Yazilimi

CVE-2023-6441

SQLi in UNI-PA's University Information System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UNI-PA University Marketing & Computer Internet Trade Inc. University Information System allows SQL Injection. This issue affects University Information System: before 12.12.2023.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Uni-pa University Marketing And Computer Internet Trade Inc Unipa

Products

University Information System University Information System

CVE-2026-8726

SQL Injection in extension "News system" (news)

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "news System"

CVE-2026-8827

SQL Injection in extension "Address List" (tt_address)

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "address List"

CVE-2026-5586

zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injection

A vulnerability was determined in zhongyu09 openchatbi up to 0.2.1. The impacted element is an unknown function of the component Multi-stage Text2SQL Workflow. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zhongyu09

Products

Openchatbi

CVE-2023-6677

SQLi in Oduyo Online Collection Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Technology Online Collection allows SQL Injection. This issue affects Online Collection: before v.1.0.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Oduyo

Products

Online Collection

CVE-2023-7081

SQLi in PosTahsil's Online Payment System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection. This issue affects Online Payment System: before 14.02.2024.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Postahsil

Products

Online Payment System

CVE-2022-0495

SQL Injection in KOHA

The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Parantezteknoloji

Products

Koha Library Automation

CVE-2022-1277

SQL Injection in Inavitas Solar Log

Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Inavitas

Products

Solar Log

CVE-2022-2177

SQL Injection in Kayrasoft

Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Kayrasoft

Products

Kayrasoft

CVE-2022-2315

SQL Injection in Database Accreditation System

Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Databank

Products

Accreditation Tracking\/presentation Module

CVE-2022-2504

SQLi in SDD-Baro

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SDD Computer Software SDD-Baro allows SQL Injection. This issue affects SDD-Baro: before 2.8.432.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Sdd-baro Project

Products

Sdd-baro