Search
Total
2383 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-24931 | 1 Ays-pro | 1 Secure Copy Content Protection And Content Locking | 2022-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection. | |||||
| CVE-2021-44868 | 1 Mingsoft | 1 Mcms | 2022-02-25 | 7.5 HIGH | 9.8 CRITICAL |
| A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do | |||||
| CVE-2022-25322 | 1 Zerof | 1 Web Server | 2022-02-24 | 7.5 HIGH | 9.8 CRITICAL |
| ZEROF Web Server 2.0 allows /HandleEvent SQL Injection. | |||||
| CVE-2022-22881 | 1 Jeecg | 1 Jeecg Boot | 2022-02-24 | 7.5 HIGH | 9.8 CRITICAL |
| Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData. | |||||
| CVE-2022-22880 | 1 Jeecg | 1 Jeecg Boot | 2022-02-24 | 7.5 HIGH | 9.8 CRITICAL |
| Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId. | |||||
| CVE-2021-3242 | 1 Duxcms Project | 1 Duxcms | 2022-02-24 | 7.5 HIGH | 9.8 CRITICAL |
| DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=. | |||||
| CVE-2022-23358 | 1 Easycms | 1 Easycms | 2022-02-23 | 7.5 HIGH | 9.8 CRITICAL |
| EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQL statement. | |||||
| CVE-2022-22295 | 1 Metinfo | 1 Metinfo | 2022-02-22 | 7.5 HIGH | 9.8 CRITICAL |
| Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter. | |||||
| CVE-2022-23335 | 1 Metinfo | 1 Metinfo | 2022-02-22 | 7.5 HIGH | 9.8 CRITICAL |
| Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter. | |||||
| CVE-2022-23336 | 1 S-cms | 1 S-cms | 2022-02-22 | 7.5 HIGH | 9.8 CRITICAL |
| S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter. | |||||
| CVE-2022-23337 | 1 Dedecms | 1 Dedecms | 2022-02-22 | 7.5 HIGH | 9.8 CRITICAL |
| DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter. | |||||
| CVE-2022-24223 | 1 Thedigitalcraft | 1 Atomcms | 2022-02-22 | 7.5 HIGH | 9.8 CRITICAL |
| AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. | |||||
| CVE-2021-24762 | 1 Getperfectsurvey | 1 Perfect Survey | 2022-02-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection. | |||||
| CVE-2021-25076 | 1 Wedevs | 1 Wp User Frontend | 2022-02-21 | 7.5 HIGH | 9.8 CRITICAL |
| The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting | |||||
| CVE-2021-34235 | 1 Tsg-solutions | 1 Tokheim Profleet Dialog | 2022-02-18 | 10.0 HIGH | 9.8 CRITICAL |
| Tokheim Profleet DiaLOG 11.005.02 is affected by SQL Injection. The component is the Field__UserLogin parameter on the logon page. | |||||
| CVE-2015-9323 | 1 Duckdev | 1 404 To 301 | 2022-02-16 | 7.5 HIGH | 9.8 CRITICAL |
| The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection. | |||||
| CVE-2021-25114 | 1 Strangerstudios | 1 Paid Memberships Pro | 2022-02-10 | 7.5 HIGH | 9.8 CRITICAL |
| The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection | |||||
| CVE-2021-43927 | 1 Synology | 1 Diskstation Manager | 2022-02-10 | 7.5 HIGH | 9.8 CRITICAL |
| Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. | |||||
| CVE-2021-43926 | 1 Synology | 1 Diskstation Manager | 2022-02-10 | 7.5 HIGH | 9.8 CRITICAL |
| Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. | |||||
| CVE-2021-43925 | 1 Synology | 1 Diskstation Manager | 2022-02-10 | 7.5 HIGH | 9.8 CRITICAL |
| Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. | |||||
| CVE-2020-5722 | 1 Grandstream | 2 Ucm6200, Ucm6200 Firmware | 2022-02-10 | 10.0 HIGH | 9.8 CRITICAL |
| The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17. | |||||
| CVE-2022-23379 | 1 Emlog | 1 Emlog | 2022-02-09 | 7.5 HIGH | 9.8 CRITICAL |
| Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid(). | |||||
| CVE-2021-44779 | 1 \[gwa\] Autoresponder Project | 1 \[gwa\] Autoresponder | 2022-02-09 | 7.5 HIGH | 9.8 CRITICAL |
| Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed. | |||||
| CVE-2022-24260 | 1 Voipmonitor | 1 Voipmonitor | 2022-02-08 | 10.0 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level. | |||||
| CVE-2021-43509 | 1 Simple Client Management System Project | 1 Simple Client Management System | 2022-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the id parameter in view-service.php. | |||||
| CVE-2021-43510 | 1 Simple Client Management System Project | 1 Simple Client Management System | 2022-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php. | |||||
| CVE-2021-24946 | 1 Webnus | 1 Modern Events Calendar Lite | 2022-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue | |||||
| CVE-2021-46445 | 1 Hhg-multistore | 1 Multistore | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id. | |||||
| CVE-2021-46444 | 1 Hhg-multistore | 1 Multistore | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID. | |||||
| CVE-2021-46446 | 1 Hhg-multistore | 1 Multistore | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID. | |||||
| CVE-2021-46448 | 1 Hhg-multistore | 1 Multistore | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID. | |||||
| CVE-2021-41609 | 1 Classapps | 1 Selectsurvey.net | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve data from the application's backend database via boolean-based blind and UNION injection. | |||||
| CVE-2022-24222 | 1 Elitecms | 1 Elite Cms | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php. | |||||
| CVE-2022-24221 | 1 Elitecms | 1 Elite Cms | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php. | |||||
| CVE-2022-24220 | 1 Elitecms | 1 Elite Cms | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php. | |||||
| CVE-2022-24219 | 1 Elitecms | 1 Elite Cms | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php. | |||||
| CVE-2022-22294 | 1 Zfaka Project | 1 Zfaka | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability exists in ZFAKA<=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator account. | |||||
| CVE-2020-25905 | 1 Mobile Shop System Project | 1 Mobile Shop System | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) LoginAsAdmin.php. | |||||
| CVE-2021-44249 | 1 Online Motorcycle \(bike\) Rental System Project | 1 Online Motorcycle \(bike\) Rental System | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. This can lead attackers to remotely dump MySQL database credentials. | |||||
| CVE-2021-46377 | 1 Cskaza | 1 Cszcms | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUser | |||||
| CVE-2021-46427 | 1 Simple Chatbot Application Project | 1 Simple Chatbot Application | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| An SQL Injection vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 via the message parameter in Master.php. | |||||
| CVE-2022-0362 | 1 Showdoc | 1 Showdoc | 2022-02-02 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection in Packagist showdoc/showdoc prior to 2.10.3. | |||||
| CVE-2022-0332 | 1 Moodle | 1 Moodle | 2022-02-01 | 7.5 HIGH | 9.8 CRITICAL |
| A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data. | |||||
| CVE-2020-7500 | 1 Schneider-electric | 12 Mtn6260-0310, Mtn6260-0310 Firmware, Mtn6260-0315 and 9 more | 2022-01-31 | 7.5 HIGH | 9.8 CRITICAL |
| A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause arbitrary code to be executed when a malicious command is entered. | |||||
| CVE-2021-41659 | 1 Banking System Project | 1 Banking System | 2022-01-31 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username or password field. | |||||
| CVE-2021-41660 | 1 Patient Appointment Scheduler System Project | 1 Patient Appointment Scheduler System | 2022-01-31 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Sourcecodester Patient Appointment Scheduler System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username and password fields to login.php. | |||||
| CVE-2021-41928 | 1 Try My Recipe Project | 1 Try My Recipe | 2022-01-31 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to execute arbitrary code via the rid parameter to the view_recipe page. | |||||
| CVE-2021-46200 | 1 Simple Music Cloud Community System Project | 1 Simple Music Cloud Community System | 2022-01-31 | 10.0 HIGH | 9.8 CRITICAL |
| An SQL Injection vulnerability exists in Sourcecodester Simple Music Clour Community System 1.0 via the email parameter in /music/ajax.php. | |||||
| CVE-2021-46061 | 1 Computer And Mobile Repair Shop Management System Project | 1 Computer And Mobile Repair Shop Management System | 2022-01-28 | 10.0 HIGH | 9.8 CRITICAL |
| An SQL Injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management system (RSMS) 1.0 via the code parameter in /rsms/ node app. | |||||
| CVE-2021-45334 | 1 Online Thesis Archiving System Project | 1 Online Thesis Archiving System | 2022-01-28 | 7.5 HIGH | 9.8 CRITICAL |
| Sourcecodester Online Thesis Archiving System 1.0 is vulnerable to SQL Injection. An attacker can bypass admin authentication and gain access to admin panel using SQL Injection | |||||