CVE-2024-1100

SQLi in Vadi Corporate Information Systems' DIGIKENT GIS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQL Injection. This issue affects DIGIKENT GIS: through 2.23.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Vadi

Products

Digikent Gis

CVE-2024-0857

SQLi in Universal Software's FlexWater Corporate Water Management

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection. This issue affects FlexWater Corporate Water Management: before 5.452.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Uni-yaz Universal Software Inc

Products

Flexwater Corporate Water Management Flexwater Corporate Water Management

CVE-2024-0851

SQLi in Grup Arge Energy and Control Systems's Smartpower

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy and Control Systems Smartpower allows SQL Injection. This issue affects Smartpower: through V24.05.27.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Gruparge

Products

Smartpower

CVE-2026-24782

Kiteworks Secure Data Forms has a SQL Injection vulnerability

Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-10607

DedeCMS flink.php dede_htmlspecialchars sql injection

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Dedecms

Products

Dedecms

CVE-2026-10258

itsourcecode Content Management System add_sub_topic.php sql injection

A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the file /admin/add_sub_topic.php. This manipulation of the argument topic_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Content Management System

CVE-2024-1153

SQL Injection Vulnerability in Talya Informatics' Travel APPS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Travel APPS: before v17.0.68.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Talyabilisim

Products

Travel Apps

CVE-2024-3370

SQLi in Egebilgi Software's Website Template

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egebilgi Software Website Template allows SQL Injection. This issue affects Website Template: before 29.04.2024.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Egeabilgi Software

Products

Website Template

CVE-2024-3373

SQLi in RSM Design's Website Template

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Rsm Design

Products

Web Template

CVE-2024-4658

SQLi in TE Informatics' Nova CMS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TE Informatics Nova CMS allows SQL Injection. This issue affects Nova CMS: before 5.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Te Informatics

Products

Nova Cms

CVE-2026-10704

SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection

A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Pizzafy E-commerce System Pizzafy Ecommerce System

CVE-2025-15655

WordPress School Management plugin <= 93.2.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mojoomla Wordpress

Products

School Management Wordpress

CVE-2024-5958

SQLi in Eliz Software's Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection. This issue affects Panel: before v2.3.24.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Eliz Software Elizsoftware

Products

Panel Panel

CVE-2026-10620

code-projects Student Admission System index.php sql injection

A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.php. This manipulation of the argument eid/did causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Student Admission System

CVE-2024-6401

SQLi in SFS Consulting's InsureE GL

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection. This issue affects InsureE GL: before 4.6.2.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Sfs Sfs Consulting

Products

Insuree Gl Insuree Gl

CVE-2024-6919

SQLi in NAC Telecommunication's NACPremium

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection. This issue affects NACPremium: through 01082024.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nac Nac Telecommunication Systems

Products

Nacpremium Nacpremium

CVE-2024-7026

SQLi in Teknogis Informatics' Closed Circuit Vehicle Tracking Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informatics Closed Circuit Vehicle Tracking Software allows SQL Injection, Blind SQL Injection. This issue affects Closed Circuit Vehicle Tracking Software: through 21.11.2024. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Teknogis Informatics

Products

Close Circuit Vehicle Tracking Software

CVE-2024-7071

Unauthenticate SQLi in Brain Information Technologies' Brain Low-Code

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in Brain Information Technologies Inc. Brain Low-Code allows SQL Injection. This issue affects Brain Low-Code: before 2.1.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Brain Information Technologies Brainlowcode

Products

Brain Low-code Brain Low-code

CVE-2024-7076

SQLi in Semtek Informatics Software's Semtek Sempos

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Blind SQL Injection. This issue affects Semtek Sempos: through 31072024.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Semtek Semtekyazilim

Products

Sempos Semtek Sempos

CVE-2024-7078

Unauthenticate SQLi in Semtek Informatics Software's Semtek Sempos

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows SQL Injection. This issue affects Semtek Sempos: through 31072024.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Semtek Semtekyazilim

Products

Sempos Semtek Sempos