Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (18610 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-31519 1 Pharmacy Management System Project 1 Pharmacy Management System 2025-01-23 9.8 Critical
Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login_core.php.
CVE-2023-27742 1 Idurarapp 1 Idurar 2025-01-23 9.8 Critical
IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.
CVE-2024-26264 1 Ebmtech 1 Risweb 2025-01-23 9.8 Critical
EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.
CVE-2024-57770 1 Jfinaloa Project 1 Jfinaloa 2025-01-23 8.8 High
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id.
CVE-2024-57769 1 Jfinaloa Project 1 Jfinaloa 2025-01-23 8.8 High
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser.
CVE-2023-31613 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31612 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31611 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31610 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31609 1 Openlinksw 1 Virtuoso 2025-01-23 7.5 High
An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-30189 1 Posthemes 1 Posstaticblocks 2025-01-23 9.8 Critical
Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook().
CVE-2023-5155 1 Utarit 1 Solipay Mobile 2025-01-23 9.8 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection.This issue affects SoliPay Mobile App: before 5.0.8.
CVE-2024-48509 2 Lang-learn-guy, Learning With Texts 2 Learning With Texts, Learning With Texts 2025-01-23 9.8 Critical
Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain unauthorized access to the database, retrieve sensitive information, modify or delete data, and execute arbitrary commands.
CVE-2024-43282 1 Themeum 1 Tutor Lms 2025-01-22 7.6 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
CVE-2023-32308 1 Anuko 1 Time Tracker 2025-01-22 8.2 High
anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.
CVE-2023-27233 1 Piwigo 1 Piwigo 2025-01-22 8.8 High
Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
CVE-2023-31702 1 Escanav 1 Escan Management Console 2025-01-22 7.2 High
SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.
CVE-2023-30191 1 Cdesigner Project 1 Cdesigner 2025-01-22 9.8 Critical
PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().
CVE-2023-2756 1 Pimcore 1 Customer Management Framework 2025-01-22 7.2 High
SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
CVE-2024-3314 1 Oretnom23 1 Computer Laboratory Management System 2025-01-22 6.3 Medium
A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php. The manipulation leads to sql injection. The attack may be initiated remotely. The identifier VDB-259385 was assigned to this vulnerability.