Total
17576 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-3617 | 1 Mayurik | 1 Advocate Office Management System | 2025-01-28 | 4.7 Medium |
| A vulnerability, which was classified as critical, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This issue affects some unknown processing of the file /control/deactivate_case.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260273 was assigned to this vulnerability. | ||||
| CVE-2024-1514 | 1 Wp-ecommerce | 1 Wp Ecommerce | 2025-01-28 | 9.8 Critical |
| The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2023-32569 | 1 Veritas | 1 Infoscale Operations Manager | 2025-01-28 | 7.2 High |
| An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web application is vulnerable to SQL Injection in some of the areas of the application. This allows attackers (who must have admin credentials) to submit arbitrary SQL commands on the back-end database to create, read, update, or delete any sensitive data stored in the database. | ||||
| CVE-2023-50316 | 1 Ibm | 1 Sterling B2b Integrator | 2025-01-28 | 6.3 Medium |
| IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. | ||||
| CVE-2017-20196 | 2025-01-28 | 6.3 Medium | ||
| A vulnerability was found in Itechscripts School Management Software 2.75. It has been classified as critical. This affects an unknown part of the file /notice-edit.php. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-29889 | 1 Glpi-project | 1 Glpi | 2025-01-28 | 7.1 High |
| GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15. | ||||
| CVE-2023-30194 | 1 Prestashop | 1 Poststaticfooter | 2025-01-27 | 9.8 Critical |
| Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook(). | ||||
| CVE-2023-30192 | 1 Prestashop | 1 Possearchproducts | 2025-01-27 | 9.8 Critical |
| Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). | ||||
| CVE-2023-29863 | 1 Medisys | 1 Weblab | 2025-01-27 | 9.8 Critical |
| Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL files. | ||||
| CVE-2023-28359 | 1 Rocket.chat | 1 Rocket.chat | 2025-01-27 | 5.3 Medium |
| A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact. | ||||
| CVE-2025-24664 | 2025-01-27 | 9.3 Critical | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology LTL Freight Quotes – Worldwide Express Edition allows SQL Injection. This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.0.20. | ||||
| CVE-2023-2642 | 1 Online Exam System Project | 1 Online Exam System | 2025-01-24 | 6.3 Medium |
| A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. This affects an unknown part of the file adminpanel/admin/facebox_modal/updateCourse.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228771. | ||||
| CVE-2025-24663 | 2025-01-24 | 7.6 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Ruhul Amin, Josh Lobe Simple Download Monitor allows Blind SQL Injection. This issue affects Simple Download Monitor: from n/a through 3.9.25. | ||||
| CVE-2025-24659 | 2025-01-24 | 7.6 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WordPress Download Manager Premium Packages allows Blind SQL Injection. This issue affects Premium Packages: from n/a through 5.9.6. | ||||
| CVE-2025-24669 | 2025-01-24 | 8.5 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERPed SERPed.net allows SQL Injection. This issue affects SERPed.net: from n/a through 4.4. | ||||
| CVE-2024-25937 | 1 Deltaww | 1 Diaenergie | 2025-01-24 | 8.8 High |
| SQL injection vulnerability exists in the script DIAE_tagHandler.ashx. | ||||
| CVE-2024-13426 | 1 Wp-polls Project | 1 Wp-polls | 2025-01-24 | 5.4 Medium |
| The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries. Those queries are stored and results are not displayed to the attacker, which means they cannot be exploited to obtain any additional information about the database. However, a properly configured payload allows for the injection of malicious JavaScript resulting in Stored Cross-Site Scripting. | ||||
| CVE-2024-29870 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | 9.8 Critical |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter./sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | ||||
| CVE-2024-29871 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | 9.8 Critical |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | ||||
| CVE-2024-29872 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | 9.8 Critical |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, 'agencyids' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | ||||