CWE-89

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.

CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device/getNumByStatus URI.

In FusionPBX up to v4.5.7, the file appcall_broadcastcall_broadcast_edit.php uses an unsanitized “id” variable coming from the URL in an unparameterized SQL query, leading to SQL injection.

WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. The uid and domain parameters are used, unsanitized, in a SQL query constructed in the buildSearchWhereClause function.

download.php in inoERP 4.15 allows SQL injection through insecure deserialization.

eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.