Search
Total
1733 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-1365 | 1 Cisco | 1 Unified Communications Manager Im And Presence Service | 2021-05-14 | 5.5 MEDIUM | 8.1 HIGH |
| Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database. | |||||
| CVE-2021-1363 | 1 Cisco | 1 Unified Communications Manager Im And Presence Service | 2021-05-14 | 5.5 MEDIUM | 8.1 HIGH |
| Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database. | |||||
| CVE-2021-32104 | 1 Open-emr | 1 Openemr | 2021-05-11 | 6.5 MEDIUM | 8.8 HIGH |
| A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1. | |||||
| CVE-2021-32102 | 1 Open-emr | 1 Openemr | 2021-05-11 | 6.5 MEDIUM | 8.8 HIGH |
| A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1. | |||||
| CVE-2018-16384 | 1 Owasp | 1 Owasp Modsecurity Core Rule Set | 2021-05-10 | 5.0 MEDIUM | 7.5 HIGH |
| A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed. | |||||
| CVE-2021-25153 | 1 Arubanetworks | 1 Airwave | 2021-05-05 | 5.5 MEDIUM | 8.1 HIGH |
| A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability. | |||||
| CVE-2020-18019 | 1 Xinfu | 1 Oa System | 2021-05-05 | 5.0 MEDIUM | 7.5 HIGH |
| SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component. | |||||
| CVE-2020-22781 | 1 Etherpad | 1 Etherpad | 2021-05-05 | 5.0 MEDIUM | 7.5 HIGH |
| In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance). | |||||
| CVE-2021-27973 | 1 Piwigo | 1 Piwigo | 2021-04-30 | 6.5 MEDIUM | 7.2 HIGH |
| SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. | |||||
| CVE-2021-21427 | 1 Openmage | 1 Magento | 2021-04-30 | 6.5 MEDIUM | 7.2 HIGH |
| Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9. | |||||
| CVE-2021-28419 | 1 Seopanel | 1 Seo Panel | 2021-04-27 | 6.5 MEDIUM | 7.2 HIGH |
| The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases. | |||||
| CVE-2021-28828 | 1 Tibco | 1 Administrator | 2021-04-23 | 6.5 MEDIUM | 8.8 HIGH |
| The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition for z/Linux, and TIBCO Administrator - Enterprise Edition for z/Linux contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a SQL injection attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below, and TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1. | |||||
| CVE-2021-23276 | 1 Eaton | 3 Intelligent Power Manager, Intelligent Power Manager Virtual Appliance, Intelligent Power Protector | 2021-04-21 | 6.5 MEDIUM | 8.8 HIGH |
| Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base. | |||||
| CVE-2021-28157 | 1 Devolutions | 1 Devolutions Server | 2021-04-21 | 6.5 MEDIUM | 7.2 HIGH |
| An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL commands via a username in api/security/userinfo/delete. | |||||
| CVE-2017-7717 | 1 Sap | 1 Netweaver Application Server Java | 2021-04-20 | 6.5 MEDIUM | 8.8 HIGH |
| SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504. | |||||
| CVE-2021-24221 | 1 Expresstech | 1 Quiz And Survey Master | 2021-04-20 | 6.5 MEDIUM | 8.8 HIGH |
| The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection. | |||||
| CVE-2021-28142 | 1 Citsmart | 1 Citsmart | 2021-04-19 | 6.5 MEDIUM | 8.8 HIGH |
| CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete." | |||||
| CVE-2021-30055 | 1 Eng | 1 Knowage | 2021-04-08 | 6.5 MEDIUM | 8.8 HIGH |
| A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report. | |||||
| CVE-2021-28245 | 1 Pbootcms | 1 Pbootcms | 2021-04-05 | 5.0 MEDIUM | 7.5 HIGH |
| PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account. | |||||
| CVE-2020-36002 | 1 Seat-reservation-system Project | 1 Seat-reservation-system | 2021-04-01 | 5.0 MEDIUM | 7.5 HIGH |
| Seat-Reservation-System 1.0 has a SQL injection vulnerability in index.php in the id parameter where attackers can obtain sensitive database information. | |||||
| CVE-2020-27869 | 1 Solarwinds | 1 Network Performance Monitor | 2021-03-26 | 9.0 HIGH | 8.8 HIGH |
| This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2. Authentication is required to exploit this vulnerability. The specific flaw exists within the WriteToFile method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges and reset the password for the Admin user. Was ZDI-CAN-11804. | |||||
| CVE-2021-26578 | 1 Hpe | 1 Network Orchestrator | 2021-03-25 | 5.0 MEDIUM | 7.5 HIGH |
| A potential security vulnerability has been identified in HPE Network Orchestrator (NetO) version(s): Prior to 2.5. The vulnerability could be remotely exploited with SQL injection. | |||||
| CVE-2021-24130 | 1 Flippercode | 1 Wp Google Map | 2021-03-24 | 6.5 MEDIUM | 7.2 HIGH |
| Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+). | |||||
| CVE-2021-24131 | 1 Cleantalk | 1 Anti-spam | 2021-03-24 | 6.5 MEDIUM | 7.2 HIGH |
| Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, it requires high privilege user (admin+). | |||||
| CVE-2021-24132 | 1 10web | 1 Slider | 2021-03-24 | 6.5 MEDIUM | 8.8 HIGH |
| The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable, allowing a high privileged user (Admin), or medium one such as Contributor+ (if "Role Options" is turn on for other users) to perform a SQL Injection attacks. | |||||
| CVE-2021-27320 | 1 Doctor Appointment System Project | 1 Doctor Appointment System | 2021-03-24 | 5.0 MEDIUM | 7.5 HIGH |
| Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter. | |||||
| CVE-2021-27316 | 1 Doctor Appointment System Project | 1 Doctor Appointment System | 2021-03-24 | 5.0 MEDIUM | 7.5 HIGH |
| Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter. | |||||
| CVE-2021-27319 | 1 Doctor Appointment System Project | 1 Doctor Appointment System | 2021-03-24 | 5.0 MEDIUM | 7.5 HIGH |
| Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter. | |||||
| CVE-2021-27315 | 1 Doctor Appointment System Project | 1 Doctor Appointment System | 2021-03-24 | 5.0 MEDIUM | 7.5 HIGH |
| Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter. | |||||
| CVE-2021-21380 | 1 Xwiki | 1 Xwiki | 2021-03-24 | 6.5 MEDIUM | 8.8 HIGH |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. The problem has been patched in XWiki 12.9RC1. The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager. | |||||
| CVE-2021-26935 | 1 Wowonder | 1 Wowonder | 2021-03-24 | 5.0 MEDIUM | 7.5 HIGH |
| In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the event_id parameter. | |||||
| CVE-2021-27946 | 1 Mybb | 1 Mybb | 2021-03-23 | 6.5 MEDIUM | 8.8 HIGH |
| SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3). | |||||
| CVE-2021-24137 | 1 Adenion | 1 Blog2social | 2021-03-23 | 6.5 MEDIUM | 8.8 HIGH |
| Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands. | |||||
| CVE-2021-24149 | 1 Webnus | 1 Modern Events Calendar Lite | 2021-03-23 | 6.5 MEDIUM | 8.8 HIGH |
| Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue. | |||||
| CVE-2021-24140 | 1 Connekthq | 1 Ajax Load More | 2021-03-22 | 6.5 MEDIUM | 7.2 HIGH |
| Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test. | |||||
| CVE-2021-24141 | 1 Sigmaplugin | 1 Advanced Database Cleaner | 2021-03-22 | 6.5 MEDIUM | 7.2 HIGH |
| Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks. | |||||
| CVE-2021-24142 | 1 Premiumwpsuite | 1 Easy Redirect Manager | 2021-03-22 | 6.5 MEDIUM | 7.2 HIGH |
| Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections. | |||||
| CVE-2021-24143 | 1 Accesspressthemes | 1 Accesspress Social Icons | 2021-03-22 | 6.5 MEDIUM | 8.8 HIGH |
| Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections. | |||||
| CVE-2021-28295 | 1 Online Ordering System Project | 1 Online Ordering System | 2021-03-22 | 5.0 MEDIUM | 7.5 HIGH |
| Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to database information disclosure. | |||||
| CVE-2021-27947 | 1 Mybb | 1 Mybb | 2021-03-16 | 6.5 MEDIUM | 7.2 HIGH |
| SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3). | |||||
| CVE-2021-27948 | 1 Mybb | 1 Mybb | 2021-03-16 | 6.5 MEDIUM | 7.2 HIGH |
| SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3). | |||||
| CVE-2020-24617 | 1 Mailtrain | 1 Mailtrain | 2021-02-25 | 6.0 MEDIUM | 8.8 HIGH |
| Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped. | |||||
| CVE-2021-22856 | 1 Changjia Property Management System Project | 1 Changjia Property Management System | 2021-02-25 | 5.0 MEDIUM | 7.5 HIGH |
| The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege. | |||||
| CVE-2021-22854 | 1 Hr Portal Project | 1 Hr Portal | 2021-02-24 | 5.0 MEDIUM | 7.5 HIGH |
| The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege. | |||||
| CVE-2017-16000 | 1 Eyesofnetwork | 1 Eyesofnetwork | 2021-02-23 | 6.5 MEDIUM | 7.2 HIGH |
| SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php. | |||||
| CVE-2017-15933 | 1 Eyesofnetwork | 1 Eyesofnetwork | 2021-02-23 | 6.5 MEDIUM | 7.2 HIGH |
| SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacity_per_device/index.php. | |||||
| CVE-2017-15880 | 1 Eyesofnetwork | 1 Eyesofnetwork | 2021-02-23 | 6.5 MEDIUM | 7.2 HIGH |
| SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php (for insert_group and update_group). | |||||
| CVE-2020-22425 | 1 Centreon | 1 Centreon | 2021-02-22 | 6.5 MEDIUM | 8.8 HIGH |
| Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command execution. | |||||
| CVE-2020-29140 | 1 Open-emr | 1 Openemr | 2021-02-22 | 6.5 MEDIUM | 7.2 HIGH |
| A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter. | |||||
| CVE-2020-29143 | 1 Open-emr | 1 Openemr | 2021-02-22 | 6.5 MEDIUM | 7.2 HIGH |
| A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter. | |||||