Search
Total
2383 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-7410 | 1 Websitebaker | 1 Websitebaker | 2020-07-07 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter. | |||||
| CVE-2020-15468 | 1 Persian Vip Download Script Project | 1 Persian Vip Download Script | 2020-07-07 | 7.5 HIGH | 9.8 CRITICAL |
| Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter. | |||||
| CVE-2020-13381 | 1 Os4ed | 1 Opensis | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| openSIS through 7.4 allows SQL Injection. | |||||
| CVE-2020-13640 | 1 Gvectors | 1 Wpdiscuz | 2020-07-06 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.) | |||||
| CVE-2020-13380 | 1 Os4ed | 1 Opensis | 2020-07-02 | 7.5 HIGH | 9.8 CRITICAL |
| openSIS before 7.4 allows SQL Injection. | |||||
| CVE-2017-18888 | 1 Mattermost | 1 Mattermost Server | 2020-06-26 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts. | |||||
| CVE-2020-14972 | 1 Pisay Online E-learning System Project | 1 Pisay Online E-learning System | 2020-06-26 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email, user_pass, and id parameters on the admin login-portal and the edit-lessons webpages. | |||||
| CVE-2018-18755 | 1 K-iwi | 1 K-iwi | 2020-06-25 | 7.5 HIGH | 9.8 CRITICAL |
| K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/update user_id parameter. | |||||
| CVE-2020-14054 | 1 Sokkia | 2 Gnr5 Vanguard, Gnr5 Vanguard Firmware | 2020-06-23 | 7.5 HIGH | 9.8 CRITICAL |
| SOKKIA GNR5 Vanguard WEB version 1.2 (build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3) and hardware version 212 allows remote attackers to bypass admin authentication via a SQL injection attack that uses the User Name or Password field on the login page. | |||||
| CVE-2020-7471 | 1 Djangoproject | 1 Django | 2020-06-19 | 7.5 HIGH | 9.8 CRITICAL |
| Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL. | |||||
| CVE-2018-18084 | 1 Comsenz | 1 Duomicms | 2020-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter. | |||||
| CVE-2020-8967 | 1 Gesio | 1 Erp | 2020-06-04 | 7.5 HIGH | 9.8 CRITICAL |
| There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information. | |||||
| CVE-2018-7315 | 1 Harmistechnology | 1 Ek Rishta | 2020-06-03 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameter. | |||||
| CVE-2014-8941 | 1 Piwigo | 1 Lexiglot | 2020-06-02 | 7.5 HIGH | 9.8 CRITICAL |
| Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI. | |||||
| CVE-2020-13433 | 1 Adminpanel Project | 1 Adminpanel | 2020-05-27 | 7.5 HIGH | 9.8 CRITICAL |
| Jason2605 AdminPanel 4.0 allows SQL Injection via the editPlayer.php hidden parameter. | |||||
| CVE-2017-9730 | 1 Dfsol | 1 Nuevomailer | 2020-05-22 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the "r" parameter. | |||||
| CVE-2018-18761 | 1 Saltos | 1 Saltos | 2020-05-20 | 7.5 HIGH | 9.8 CRITICAL |
| SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection. | |||||
| CVE-2020-13118 | 1 Mikrotik-router-monitoring-system Project | 1 Mikrotik-router-monitoring-system | 2020-05-19 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community.php via the parameter community. | |||||
| CVE-2020-11530 | 1 Idangero | 1 Chop Slider | 2020-05-13 | 7.5 HIGH | 9.8 CRITICAL |
| A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user. | |||||
| CVE-2020-12766 | 1 Solis | 1 Gnuteca | 2020-05-12 | 7.5 HIGH | 9.8 CRITICAL |
| Gnuteca 3.8 allows action=main:search:simpleSearch SQL Injection via the exemplaryStatusId parameter. | |||||
| CVE-2020-11942 | 1 Opmantek | 1 Open-audit | 2020-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections. | |||||
| CVE-2020-12429 | 1 Phpgurukul | 1 Online Course Registration | 2020-05-05 | 7.5 HIGH | 9.8 CRITICAL |
| Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass in the login pages: admin/change-password.php, admin/check_availability.php, admin/index.php, change-password.php, check_availability.php, includes/header.php, index.php, and pincode-verification.php. | |||||
| CVE-2020-12442 | 1 Ivanti | 1 Avalanche | 2020-05-01 | 7.5 HIGH | 9.8 CRITICAL |
| Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250. | |||||
| CVE-2020-10505 | 1 The School Manage System Project | 1 The School Manage System | 2020-04-30 | 7.5 HIGH | 9.8 CRITICAL |
| The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of SQL Injection, an attacker can use a union based injection query string to get databases schema and username/password. | |||||
| CVE-2017-7991 | 1 Exponentcms | 1 Exponent Cms | 2020-04-28 | 7.5 HIGH | 9.8 CRITICAL |
| Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php. | |||||
| CVE-2020-11812 | 1 Rukovoditel | 1 Rukovoditel | 2020-04-23 | 7.5 HIGH | 9.8 CRITICAL |
| Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters[0][value] or filters[1][value] parameter. | |||||
| CVE-2019-20730 | 1 Netgear | 74 D3600, D3600 Firmware, D6000 and 71 more | 2020-04-22 | 7.5 HIGH | 9.8 CRITICAL |
| Certain NETGEAR devices are affected by SQL injection. This affects D3600 before 1.0.0.68, D6000 before 1.0.0.68, D6200 before 1.1.00.28, D6220 before 1.0.0.40, D6400 before 1.0.0.74, D7000 before 1.0.1.60, D7000v2 before 1.0.0.74, D7800 before 1.0.1.34, D8500 before 1.0.3.39, DC112A before 1.0.0.40, EX8000 before 1.0.0.118, JR6150 before 1.0.1.18, R6050 before 1.0.1.18, R6220 before 1.1.0.66, R6250 before 1.0.4.26, R6300v2 before 1.0.4.24, R6400 before 1.0.1.36, R6400v2 before 1.0.2.52, R6700 before 1.0.1.44, R6700v2 before 1.2.0.16, R6800 before 1.2.0.16, R6900v2 before 1.2.0.16, R6900 before 1.0.1.44, R7000 before 1.0.9.26, R6900P before 1.3.0.20, R7000P before 1.3.0.20, R7100LG before 1.0.0.40, R7300DST before 1.0.0.62, R7500 before 1.0.0.118, R7500v2 before 1.0.3.26, R7800 before 1.0.2.40, R7900 before 1.0.2.10, R8000 before 1.0.4.12, R7900P before 1.3.0.10, R8000P before 1.3.0.10, R8300 before 1.0.2.116, R8500 before 1.0.2.116, R8900 before 1.0.3.6, R9000 before 1.0.3.10, WNDR3700v4 before 1.0.2.102, WNDR3700v5 before 1.1.0.54, WNDR4300v1 before 1.0.2.98, WNDR4300v2 before 1.0.0.56, and WNDR4500v3 before 1.0.0.56. | |||||
| CVE-2020-11816 | 1 Rukovoditel | 1 Rukovoditel | 2020-04-22 | 7.5 HIGH | 9.8 CRITICAL |
| Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports_id (POST) parameter. | |||||
| CVE-2020-11537 | 1 Onlyoffice | 1 Document Server | 2020-04-22 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API. | |||||
| CVE-2020-11820 | 1 Rukovoditel | 1 Rukovoditel | 2020-04-20 | 7.5 HIGH | 9.8 CRITICAL |
| Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities_id parameter. | |||||
| CVE-2019-16383 | 1 Ipswitch | 1 Moveit Transfer | 2020-04-14 | 7.5 HIGH | 9.4 CRITICAL |
| MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API, aka SQL Injection. | |||||
| CVE-2018-17842 | 1 Scriptzee | 1 Hotel Booking Engine | 2020-04-14 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels h_room_type parameter. | |||||
| CVE-2018-17410 | 1 Horus Cms Project | 1 Horus Cms | 2020-04-14 | 7.5 HIGH | 9.8 CRITICAL |
| Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI. | |||||
| CVE-2020-11597 | 1 Cipplanner | 1 Cipace | 2020-04-07 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner. | |||||
| CVE-2020-11545 | 1 Projectworlds | 1 Official Car Rental System | 2020-04-06 | 7.5 HIGH | 9.8 CRITICAL |
| Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters (login.php), and id parameter (book_car.php) This allows an attacker to dump the MySQL database and to bypass the login authentication prompt. | |||||
| CVE-2020-8638 | 1 Testlink | 1 Testlink | 2020-04-06 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter. | |||||
| CVE-2020-8637 | 1 Testlink | 1 Testlink | 2020-04-06 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter. | |||||
| CVE-2020-6009 | 1 Learndash | 1 Learndash | 2020-04-02 | 7.5 HIGH | 9.8 CRITICAL |
| LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection. | |||||
| CVE-2020-3936 | 1 Unisoon | 2 Ultralog Express, Ultralog Express Firmware | 2020-03-31 | 7.5 HIGH | 9.8 CRITICAL |
| UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command. | |||||
| CVE-2016-11023 | 1 Odata4j Project | 1 Odata4j | 2020-03-30 | 7.5 HIGH | 9.8 CRITICAL |
| odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued. | |||||
| CVE-2016-11024 | 1 Odata4j Project | 1 Odata4j | 2020-03-30 | 7.5 HIGH | 9.8 CRITICAL |
| odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued. | |||||
| CVE-2019-20576 | 1 Google | 1 Android | 2020-03-30 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on Samsung mobile devices with P(9.0) software. The MemorySaver Content Provider allows SQL injection. The Samsung ID is SVE-2019-14365 (August 2019). | |||||
| CVE-2020-10230 | 1 Centos-webpanel | 1 Centos Web Panel | 2020-03-19 | 7.5 HIGH | 9.8 CRITICAL |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter. | |||||
| CVE-2020-3922 | 1 Armorx | 1 Lisomail | 2020-03-19 | 7.5 HIGH | 9.8 CRITICAL |
| LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation. | |||||
| CVE-2020-10380 | 1 R-consortium | 1 Rmysql | 2020-03-19 | 7.5 HIGH | 9.8 CRITICAL |
| RMySQL through 0.10.19 allows SQL Injection. | |||||
| CVE-2020-10563 | 1 Devome | 1 Grr | 2020-03-18 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in DEVOME GRR before 3.4.1c. frmcontactlist.php mishandles a SQL query. | |||||
| CVE-2020-10243 | 1 Joomla | 1 Joomla\! | 2020-03-18 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype. | |||||
| CVE-2020-8786 | 1 Salesagility | 1 Suitecrm | 2020-03-18 | 7.5 HIGH | 9.8 CRITICAL |
| SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4). | |||||
| CVE-2020-8785 | 1 Salesagility | 1 Suitecrm | 2020-03-18 | 7.5 HIGH | 9.8 CRITICAL |
| SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4). | |||||
| CVE-2020-8784 | 1 Salesagility | 1 Suitecrm | 2020-03-18 | 7.5 HIGH | 9.8 CRITICAL |
| SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4). | |||||