Export limit exceeded: 424083 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (21682 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-0498 | 1 Projectworlds | 1 Online Lawyer Management System | 2026-06-17 | 6.3 Medium |
| A vulnerability was found in Project Worlds Lawyer Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250603. | ||||
| CVE-2024-0489 | 1 Code-projects | 1 Fighting Cock Information System | 2026-06-17 | 6.3 Medium |
| A vulnerability was found in code-projects Fighting Cock Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/action/edit_chicken.php. The manipulation of the argument ref leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250594 is the identifier assigned to this vulnerability. | ||||
| CVE-2024-0486 | 1 Code-projects | 1 Fighting Cock Information System | 2026-06-17 | 6.3 Medium |
| A vulnerability has been found in code-projects Fighting Cock Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/action/add_con.php. The manipulation of the argument chicken leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250591. | ||||
| CVE-2024-0479 | 1 Jifeer | 1 Taokeyun | 2026-06-17 | 7.3 High |
| A vulnerability was found in Taokeyun up to 1.0.5. It has been classified as critical. Affected is the function login of the file application/index/controller/m/User.php of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250584. | ||||
| CVE-2024-0475 | 1 Code-projects | 1 Dormitory Management System | 2026-06-17 | 6.3 Medium |
| A vulnerability, which was classified as critical, has been found in code-projects Dormitory Management System 1.0. Affected by this issue is some unknown functionality of the file modifyuser.php. The manipulation of the argument user_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250580. | ||||
| CVE-2024-0426 | 1 Foru Cms Project | 1 Foru Cms | 2026-06-17 | 6.3 Medium |
| A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. This issue affects some unknown processing of the file admin/cms_template.php. The manipulation of the argument t_name/t_path leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250445 was assigned to this vulnerability. | ||||
| CVE-2023-4776 | 1 Igexsolutions | 1 Wpschoolpress | 2026-06-17 | 8.8 High |
| The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers. | ||||
| CVE-2023-49085 | 1 Cacti | 1 Cacti | 2026-06-17 | 8.8 High |
| Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist. | ||||
| CVE-2023-43640 | 1 Speciesfilegroup | 1 Taxonworks | 2026-06-17 | 6.5 Medium |
| TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table). This issue may lead to information disclosure. Version 0.34.0 contains a fix for the issue. | ||||
| CVE-2023-42236 | 1 Seling | 1 Visual Access Manager | 2026-06-17 | 3.8 Low |
| An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php. | ||||
| CVE-2023-39643 | 1 Blmodules | 1 Xmlfeeds Pro | 2026-06-17 | 9.8 Critical |
| Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds(). | ||||
| CVE-2023-30848 | 1 Pimcore | 1 Pimcore | 2026-06-17 | 8.8 High |
| Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually. | ||||
| CVE-2023-25158 | 1 Geotools | 1 Geotools | 2026-06-17 | 9.8 Critical |
| GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation. | ||||
| CVE-2023-25157 | 1 Osgeo | 1 Geoserver | 2026-06-17 | 9.8 Critical |
| GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse. | ||||
| CVE-2023-24956 | 1 Forget Heart Message Box Project | 1 Forget Heart Message Box | 2026-06-17 | 8.8 High |
| Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php. | ||||
| CVE-2022-46121 | 1 Helmet Store Showroom Site Project | 1 Helmet Store Showroom Site | 2026-06-17 | 7.2 High |
| Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/manage_product&id=. | ||||
| CVE-2022-45822 | 1 Elbtide | 1 Advanced Booking Calendar | 2026-06-17 | 10 Critical |
| Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress. | ||||
| CVE-2022-43860 | 1 Ibm | 1 I | 2026-06-17 | 4.3 Medium |
| IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interface. By performing an SQL injection an attacker could see user profile attributes through this interface. IBM X-Force ID: 239305. | ||||
| CVE-2022-42497 | 1 Api2cart | 1 Api2cart Bridge Connector | 2026-06-17 | 10 Critical |
| Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress. | ||||
| CVE-2022-3504 | 1 Sanitization Management System Project | 1 Sanitization Management System | 2026-06-17 | 6.3 Medium |
| A vulnerability was found in SourceCodester Sanitization Management System and classified as critical. This issue affects some unknown processing of the file /php-sms/?p=services/view_service. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210839. | ||||