Search
Total
2383 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2011-1933 | 1 Jifty\ | 1 \ | 2020-01-13 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Jifty::DBI before 0.68. | |||||
| CVE-2019-7478 | 1 Sonicwall | 1 Global Management System | 2020-01-09 | 7.5 HIGH | 9.8 CRITICAL |
| A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS versions GMS 8.4, 8.5, 8.6, 8.7, 9.0 and 9.1. | |||||
| CVE-2014-8673 | 1 Soplanning | 1 Soplanning | 2020-01-08 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33. | |||||
| CVE-2017-18514 | 1 Simplerealtytheme | 1 Simple Login Log | 2020-01-07 | 7.5 HIGH | 9.8 CRITICAL |
| The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. | |||||
| CVE-2019-17527 | 1 Joomsky | 1 Js Jobs | 2020-01-02 | 7.5 HIGH | 9.8 CRITICAL |
| dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter. | |||||
| CVE-2019-18234 | 1 Equinoxce | 1 Control Expert | 2019-12-30 | 7.5 HIGH | 9.8 CRITICAL |
| Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely execute arbitrary code. | |||||
| CVE-2019-19649 | 1 Zohocorp | 1 Manageengine Applications Manager | 2019-12-19 | 7.5 HIGH | 9.8 CRITICAL |
| Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function. | |||||
| CVE-2016-1000113 | 1 Huge-it | 1 Gallery | 2019-12-19 | 7.5 HIGH | 9.8 CRITICAL |
| XSS and SQLi in huge IT gallery v1.1.5 for Joomla | |||||
| CVE-2019-19846 | 1 Joomla | 1 Joomla\! | 2019-12-18 | 7.5 HIGH | 9.8 CRITICAL |
| In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. | |||||
| CVE-2018-7282 | 1 Titool | 1 Printmonitor | 2019-12-18 | 7.5 HIGH | 9.8 CRITICAL |
| The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi. | |||||
| CVE-2019-14314 | 1 Imagely | 1 Nextgen Gallery | 2019-12-16 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php. | |||||
| CVE-2013-5743 | 1 Zabbix | 1 Zabbix | 2019-12-16 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. | |||||
| CVE-2014-7257 | 1 Dbd\ | 1 \ | 2019-12-16 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in DBD::PgPP 0.05 and earlier | |||||
| CVE-2019-15933 | 1 Intesync | 1 Solismed | 2019-12-13 | 7.5 HIGH | 9.8 CRITICAL |
| Intesync Solismed 3.3sp has SQL Injection. | |||||
| CVE-2019-19245 | 1 Napc | 1 Xinet Elegant 6 Asset Library | 2019-12-11 | 7.5 HIGH | 9.8 CRITICAL |
| NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used. | |||||
| CVE-2011-1939 | 3 Debian, Php, Zend | 3 Debian Linux, Php, Zend Framework | 2019-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6. | |||||
| CVE-2013-2745 | 2 Debian, Minidlna Project | 2 Debian Linux, Minidlna | 2019-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0 | |||||
| CVE-2011-3584 | 1 Guidestar | 1 Wec Discussion Forum | 2019-12-05 | 7.5 HIGH | 9.8 CRITICAL |
| The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input. | |||||
| CVE-2011-3583 | 1 Typo3 | 1 Typo3 | 2019-12-05 | 7.5 HIGH | 9.8 CRITICAL |
| It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input. | |||||
| CVE-2019-18662 | 1 Youphptube | 1 Youphptube | 2019-12-04 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in YouPHPTube through 7.7. User input passed through the live_stream_code POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized (in getFromChat in plugin/LiveChat/Objects/LiveChatObj.php) before being used to construct a SQL query. This can be exploited by malicious users to, e.g., read sensitive data from the database through in-band SQL Injection attacks. Successful exploitation of this vulnerability requires the Live Chat plugin to be enabled. | |||||
| CVE-2019-19250 | 1 Opentrade Project | 1 Opentrade | 2019-12-04 | 7.5 HIGH | 9.8 CRITICAL |
| OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js. | |||||
| CVE-2018-10759 | 1 Projectpier | 1 Projectpier | 2019-12-03 | 7.5 HIGH | 9.8 CRITICAL |
| PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter. | |||||
| CVE-2019-19113 | 1 Newbee-mall Project | 1 Newbee-mall | 2019-12-03 | 7.5 HIGH | 9.8 CRITICAL |
| main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection. | |||||
| CVE-2013-2091 | 1 Dolibarr | 1 Dolibarr | 2019-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php. | |||||
| CVE-2019-10766 | 1 Pixie Project | 1 Pixie | 2019-11-20 | 7.5 HIGH | 9.8 CRITICAL |
| Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization. | |||||
| CVE-2019-12989 | 1 Citrix | 2 Netscaler Sd-wan, Sd-wan | 2019-11-20 | 7.5 HIGH | 9.8 CRITICAL |
| Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. | |||||
| CVE-2011-2936 | 1 Elgg | 1 Elgg | 2019-11-12 | 7.5 HIGH | 9.8 CRITICAL |
| Elgg through 1.7.10 has a SQL injection vulnerability | |||||
| CVE-2019-12918 | 1 Quest | 1 Kace Systems Management Appliance | 2019-11-07 | 7.5 HIGH | 9.8 CRITICAL |
| Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir]. | |||||
| CVE-2019-18784 | 1 Salesagility | 1 Suitecrm | 2019-11-06 | 7.5 HIGH | 9.8 CRITICAL |
| SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. | |||||
| CVE-2019-18464 | 1 Ipswitch | 1 Moveit Transfer | 2019-11-06 | 7.5 HIGH | 9.8 CRITICAL |
| In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database. | |||||
| CVE-2019-18663 | 1 Isl | 1 Arp-guard | 2019-11-05 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter. | |||||
| CVE-2018-16659 | 1 Rausoft | 1 Id.prove | 2019-11-05 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation. | |||||
| CVE-2013-2738 | 1 Readymedia Project | 1 Readymedia | 2019-11-04 | 7.5 HIGH | 9.8 CRITICAL |
| minidlna has SQL Injection that may allow retrieval of arbitrary files | |||||
| CVE-2009-4899 | 1 Pixelpost | 1 Pixelpost | 2019-11-01 | 7.5 HIGH | 9.8 CRITICAL |
| pixelpost 1.7.1 has SQL injection | |||||
| CVE-2019-10762 | 1 Medoo | 1 Medoo | 2019-11-01 | 7.5 HIGH | 9.8 CRITICAL |
| columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping. | |||||
| CVE-2019-10748 | 1 Sequelizejs | 1 Sequelize | 2019-10-31 | 7.5 HIGH | 9.8 CRITICAL |
| Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects. | |||||
| CVE-2019-10749 | 1 Sequelizejs | 1 Sequelize | 2019-10-31 | 7.5 HIGH | 9.8 CRITICAL |
| sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect. | |||||
| CVE-2015-0270 | 1 Zend | 1 Framework | 2019-10-30 | 7.5 HIGH | 9.8 CRITICAL |
| Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter. | |||||
| CVE-2019-18387 | 1 Hotel And Lodge Management System Project | 1 Hotel And Lodge Management System | 2019-10-28 | 7.5 HIGH | 9.8 CRITICAL |
| Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the id parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. | |||||
| CVE-2019-13409 | 1 Topmeeting | 1 Topmeeting | 2019-10-22 | 5.0 MEDIUM | 9.8 CRITICAL |
| A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19). An attacker can use a union based injection query string though a search meeting room feature to get databases schema and username/password. | |||||
| CVE-2019-10752 | 1 Sequelizejs | 1 Sequelize | 2019-10-21 | 7.5 HIGH | 9.8 CRITICAL |
| Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite. | |||||
| CVE-2015-9466 | 1 Webtechideas | 1 Wti Like Post | 2019-10-17 | 7.5 HIGH | 9.8 CRITICAL |
| The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable. | |||||
| CVE-2019-17553 | 1 Metinfo | 1 Metinfo | 2019-10-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI. | |||||
| CVE-2019-17552 | 1 Idreamsoft | 1 Icms | 2019-10-16 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload. | |||||
| CVE-2019-17580 | 1 Dormsystem Project | 1 Dormsystem | 2019-10-16 | 7.5 HIGH | 9.8 CRITICAL |
| tonyy dormsystem through 1.3 allows SQL Injection in admin.php. | |||||
| CVE-2019-10757 | 1 Knexjs | 1 Knex | 2019-10-15 | 7.5 HIGH | 9.8 CRITICAL |
| knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB. | |||||
| CVE-2019-17429 | 1 Adhouma Cms Project | 1 Adhouma Cms | 2019-10-11 | 7.5 HIGH | 9.8 CRITICAL |
| Adhouma CMS through 2019-10-09 has SQL Injection via the post.php p_id parameter. | |||||
| CVE-2015-9467 | 1 K-78 | 1 Broken Link Manager | 2019-10-11 | 7.5 HIGH | 9.8 CRITICAL |
| The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter. | |||||
| CVE-2019-17072 | 1 Awplife | 1 Contact Form Widget | 2019-10-10 | 7.5 HIGH | 9.8 CRITICAL |
| The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php. | |||||
| CVE-2019-9885 | 1 Eclass | 1 Eclass Ip | 2019-10-09 | 7.5 HIGH | 9.8 CRITICAL |
| eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter. | |||||