CVE-2025-28904

CRITICAL Year: 2025
CVSS v3 Score
9.3
Critical
Weakness Type
CWE-89
View all →

Vulnerability Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shamalli Web Directory Free allows Blind SQL Injection. This issue affects Web Directory Free: from n/a through 1.7.6.

Related Vulnerabilities

CVE-2019-7003

CRITICAL
CVSS:9.3(Critical)

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other...

CWE-892019

CVE-2020-9265

CRITICAL
CVSS:9.3(Critical)

phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username.

CWE-892020

CVE-2023-28787

CRITICAL
CVSS:9.3(Critical)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1...

CWE-892023

CVE-2024-32128

CRITICAL
CVSS:9.3(Critical)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Realtyna Realtyna Organic IDX plugin.This issue affects Realtyna Organic IDX plugin: from n/a thro...

CWE-892024

CVE-2024-32709

CRITICAL
CVSS:9.3(Critical)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.

CWE-892024

CVE-2024-33544

CRITICAL
CVSS:9.3(Critical)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZone: from n/a through 14.0.10.

CWE-892024