Export limit exceeded: 21746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,746

Export CSV
CVE-2025-6830

SQLi in Xpoda Türkiye Information Technology's Password Module

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module allows SQL Injection. This issue affects Password Module: through 11022026.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Xpoda Turkiye Information Technology
Products
Xpoda Studio
CVE-2025-6918

SQLi in Ncvav's Virtual PBX Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ncvav
Products
Virtual Pbx Software
CVE-2025-6919

SQLi in Cats Informatics' Aykome

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technologies Aykome License Tracking System allows SQL Injection. This issue affects Aykome License Tracking System: before Version dated 06.10.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-7631

Time-Based Blind SQLi in Tumeva Internet Technologies' Tumeva Prime News Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tumeva Internet Technologies Software Information Advertising and Consulting Services Trade Ltd. Co. Tumeva Prime News Software allows SQL Injection. This issue affects Tumeva Prime News Software: from v.1.0.1 before v1.0.2.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Tumeva Internet Technologies Software Information Advertising And Consulting Services Trade Ltd. Co.
Products
Tumeva News Software
CVE-2025-7636

SQLi in Ergosis Security Systems' ZEUS PDKS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc. ZEUS PDKS allows SQL Injection. This issue affects ZEUS PDKS: from <1.0.5.10 through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ergosis Security Systems Computer Industry And Trade Inc.
Products
Zeus Pdks
CVE-2025-7714

Time Based SQLi in Global Medya's PHP CMS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows Command Line Execution through SQL Injection. This issue affects Content Management System (CMS): through 21072025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Global Interactive Design Media Software Globalmedya
Products
Content Management System Content Management System
CVE-2024-6699

SQLi in Mikafon Electronic's Mikafon MA7

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection. This issue affects Mikafon MA7: from v3.0 before v3.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Mikafon Mikafonelectronic
Products
Ma7 Ma7 Firmware Mikafon Ma7 Firmware
CVE-2025-7744

SQLi in Dolusoft's Omaspot

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection. This issue affects Omaspot: before 12.09.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Dolusoft
Products
Omaspot
CVE-2025-8587

Time-Based Blind SQLi in AKCE Software's SKSPro

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows SQL Injection. This issue affects SKSPro: through 07012026.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akce Akceyazilim
Products
Skspro Skspro
CVE-2025-10437

SQLi in Exagate's Webpack Management System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Eksagate
Products
Webpack Management System
CVE-2026-4104

SQLi in Akmer Informatics' TeknoPass

Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass allows SQL Injection. This issue affects TeknoPass: from 20210501 through 20260429.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Akmer
Products
Teknopass
CVE-2019-25726

All in One Video Downloader 1.2 SQL Injection via admin page-edit

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames, databases, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nicheoffice
Products
All In One Video Downloader
CVE-2019-25730

Listing Hub CMS 1.0 SQL Injection via pages.php id

Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to pages.php with crafted id values using error-based SQL injection techniques to extract database credentials, usernames, and version information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Themerig
Products
Listing Hub Cms
CVE-2019-25732

PHP EI-Tube Script 3 SQL Injection via search parameter

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to extract sensitive database information including usernames, passwords, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Eitube
Products
Ei-tube
CVE-2025-10439

SQLi in Yordam Library Automation System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allows SQL Injection. This issue affects Yordam Library Automation System: from 21.5 & 21.6 before 21.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Yordam
Products
Library Automation System
CVE-2025-10610

SQLi in SFS Winsure

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure allows Blind SQL Injection. This issue affects Winsure: through Version dated 21.08.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sfs
Products
Winsure
CVE-2026-8653

MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemixthemes Wordpress
Products
Masterstudy Lms Wordpress
CVE-2026-49771

WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
10web Wordpress
Products
Photo Gallery Wordpress
CVE-2025-10968

SQLi in GG Soft's PaperWork

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection. This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Gg Soft
Products
Paperwork