Total
14188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-44350 | 1 Thinkphp | 1 Thinkphp | 2021-12-20 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php. | |||||
| CVE-2021-43822 | 1 Jackalope Doctrine-dbal Project | 1 Jackalope Doctrine-dbal | 2021-12-17 | 6.8 MEDIUM | 7.5 HIGH |
| Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected. | |||||
| CVE-2021-44966 | 1 Employee Record Management System Project | 1 Employee Record Management System | 2021-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system. | |||||
| CVE-2021-24863 | 1 Stopbadbots | 1 Block And Stop Bad Bots | 2021-12-16 | 7.5 HIGH | 9.8 CRITICAL |
| The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection | |||||
| CVE-2021-42668 | 1 Engineers Online Portal Project | 1 Engineers Online Portal | 2021-12-16 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server. | |||||
| CVE-2021-42064 | 1 Sap | 1 Commerce | 2021-12-16 | 6.8 MEDIUM | 9.8 CRITICAL |
| If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values. | |||||
| CVE-2021-24861 | 1 Quotes Collection Project | 1 Quotes Collection | 2021-12-16 | 6.5 MEDIUM | 7.2 HIGH |
| The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement, leading to a SQL injection | |||||
| CVE-2021-24951 | 1 Thimpress | 1 Learnpress | 2021-12-16 | 7.5 HIGH | 9.8 CRITICAL |
| The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues | |||||
| CVE-2021-42945 | 1 Zzcms | 1 Zzcms | 2021-12-15 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php. | |||||
| CVE-2021-45014 | 1 Taogogo | 1 Taocms | 2021-12-15 | 7.5 HIGH | 9.8 CRITICAL |
| There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26 | |||||
| CVE-2014-7959 | 1 Ait-pro | 1 Bulletproof Security | 2021-12-15 | 6.5 MEDIUM | N/A |
| SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter. | |||||
| CVE-2021-41492 | 1 Simple Cashiering System Project | 1 Simple Cashiering System | 2021-12-15 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product Code in the pos page in cashiering. (2) id parameter in manage_products and the (3) t paramater in actions.php. | |||||
| CVE-2021-24915 | 1 Contest Gallery | 1 Contest Gallery | 2021-12-15 | 7.5 HIGH | 9.8 CRITICAL |
| The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address | |||||
| CVE-2021-43608 | 1 Doctrine-project | 1 Database Abstraction Layer | 2021-12-15 | 7.5 HIGH | 9.8 CRITICAL |
| Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API. | |||||
| CVE-2021-41695 | 1 Globaldatingsoftware | 1 Premiumdatingscript | 2021-12-14 | 7.5 HIGH | 9.8 CRITICAL |
| An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php. . | |||||
| CVE-2021-40282 | 1 Zzcms | 1 Zzcms | 2021-12-13 | 6.5 MEDIUM | 8.8 HIGH |
| An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary users. | |||||
| CVE-2021-40281 | 1 Zzcms | 1 Zzcms | 2021-12-13 | 6.5 MEDIUM | 8.8 HIGH |
| An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users. | |||||
| CVE-2021-40280 | 1 Zzcms | 1 Zzcms | 2021-12-13 | 6.5 MEDIUM | 7.2 HIGH |
| An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php. | |||||
| CVE-2021-40279 | 1 Zzcms | 1 Zzcms | 2021-12-13 | 6.5 MEDIUM | 7.2 HIGH |
| An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php. | |||||
| CVE-2021-40860 | 1 Genesys | 1 Intelligent Workload Distribution Manager | 2021-12-13 | 6.5 MEDIUM | 7.2 HIGH |
| A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) before 9.0.013.11 allows an attacker to execute arbitrary SQL queries via the ql_expression parameter, with which all data in the database can be extracted and OS command execution is possible depending on the permissions and/or database engine. | |||||