Total
14188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-45346 | 1 Projectworlds | 1 Online Food Ordering Script | 2023-11-09 | N/A | 9.8 CRITICAL |
| Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45338 | 1 Projectworlds | 1 Online Food Ordering Script | 2023-11-09 | N/A | 9.8 CRITICAL |
| Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45345 | 1 Projectworlds | 1 Online Food Ordering Script | 2023-11-09 | N/A | 9.8 CRITICAL |
| Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45347 | 1 Projectworlds | 1 Online Food Ordering Script | 2023-11-09 | N/A | 9.8 CRITICAL |
| Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45334 | 1 Projectworlds | 1 Online Food Ordering System | 2023-11-09 | N/A | 9.8 CRITICAL |
| Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45325 | 1 Projectworlds | 1 Online Food Ordering System | 2023-11-09 | N/A | 9.8 CRITICAL |
| Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45323 | 1 Projectworlds | 1 Online Food Ordering System | 2023-11-09 | N/A | 9.8 CRITICAL |
| Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45344 | 1 Projectworlds | 1 Online Food Ordering System | 2023-11-09 | N/A | 9.8 CRITICAL |
| Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_balance' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-39359 | 2 Cacti, Fedoraproject | 2 Cacti, Fedora | 2023-11-09 | N/A | 8.8 HIGH |
| Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2023-46482 | 1 Wuzhicms | 1 Wuzhicms | 2023-11-09 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/database/admin/index.php component. | |||||
| CVE-2023-44025 | 1 Addify | 1 Free Gifts | 2023-11-09 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebyid function in the AddifyfreegiftsModel.php component. | |||||
| CVE-2023-45111 | 1 Online Examination System Project | 1 Online Examination System | 2023-11-08 | N/A | 9.8 CRITICAL |
| Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45015 | 1 Online Bus Booking System Project | 1 Online Bus Booking System | 2023-11-08 | N/A | 9.8 CRITICAL |
| Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'date' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45012 | 1 Online Bus Booking System Project | 1 Online Bus Booking System | 2023-11-08 | N/A | 9.8 CRITICAL |
| Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user_email' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45019 | 1 Online Bus Booking System Project | 1 Online Bus Booking System | 2023-11-08 | N/A | 9.8 CRITICAL |
| Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-45018 | 1 Online Bus Booking System Project | 1 Online Bus Booking System | 2023-11-08 | N/A | 9.8 CRITICAL |
| Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the includes/login.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-37966 | 1 Solwininfotech | 1 User Activity Log | 2023-11-08 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection.This issue affects User Activity Log: from n/a through 1.6.2. | |||||
| CVE-2023-35879 | 1 Woo | 1 Product Vendors | 2023-11-08 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78. | |||||
| CVE-2023-44480 | 1 Projectworlds | 1 Leave Management System | 2023-11-08 | N/A | 8.8 HIGH |
| Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setcasualleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database. | |||||
| CVE-2023-46356 | 1 Blmodules | 1 Csv Feeds Pro | 2023-11-08 | N/A | 9.8 CRITICAL |
| In the module "CSV Feeds PRO" (csvfeeds) before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method `SearchApiCsv::getProducts()` has sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection. | |||||