Total
14188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-26677 | 1 Vfairs | 1 Vfairs | 2021-06-01 | 6.5 MEDIUM | 8.8 HIGH |
| Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API. | |||||
| CVE-2021-30081 | 1 Emlog | 1 Emlog | 2021-05-27 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via admin/navbar.php?action=add_page. | |||||
| CVE-2019-12348 | 1 Zzcms | 1 Zzcms | 2021-05-27 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter. | |||||
| CVE-2020-25409 | 1 College Management System Project | 1 College Management System | 2021-05-27 | 7.5 HIGH | 9.8 CRITICAL |
| Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters. | |||||
| CVE-2021-20720 | 1 Kujirahand | 1 Konawiki | 2021-05-25 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL commands and to obtain/alter the information stored in the database via unspecified vectors. | |||||
| CVE-2021-31827 | 1 Progress | 1 Moveit Transfer | 2021-05-25 | 6.5 MEDIUM | 8.8 HIGH |
| In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. This is in MOVEit.DMZ.WebApp in SILHuman.vb. | |||||
| CVE-2020-4990 | 1 Ibm | 1 Security Guardium | 2021-05-25 | 6.5 MEDIUM | 8.8 HIGH |
| IBM Security Guardium 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 192710. | |||||
| CVE-2021-29053 | 1 Liferay | 2 Dxp, Liferay Portal | 2021-05-24 | 6.5 MEDIUM | 8.8 HIGH |
| Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C. | |||||
| CVE-2021-24295 | 1 Cleantalk | 1 Spam Protection\, Antispam\, Firewall | 2021-05-24 | 5.0 MEDIUM | 7.5 HIGH |
| It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset. | |||||
| CVE-2021-24314 | 1 Boostifythemes | 1 Goto | 2021-05-24 | 7.5 HIGH | 9.8 CRITICAL |
| The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue | |||||
| CVE-2021-24285 | 1 Cars-seller-auto-classifieds-script Project | 1 Cars-seller-auto-classifieds-script | 2021-05-21 | 7.5 HIGH | 9.8 CRITICAL |
| The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue. | |||||
| CVE-2021-32615 | 1 Piwigo | 1 Piwigo | 2021-05-21 | 7.5 HIGH | 9.8 CRITICAL |
| Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection. | |||||
| CVE-2021-32051 | 1 Hexagon | 1 Intergraph G\!nius | 2021-05-21 | 5.0 MEDIUM | 7.5 HIGH |
| Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter. | |||||
| CVE-2019-19026 | 2 Linuxfoundation, Pivotal | 2 Harbor, Vmware Harbor Registry | 2021-05-21 | 4.0 MEDIUM | 4.9 MEDIUM |
| Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform. | |||||
| CVE-2019-19029 | 2 Linuxfoundation, Pivotal | 2 Harbor, Vmware Harbor Registry | 2021-05-21 | 6.5 MEDIUM | 7.2 HIGH |
| Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform. | |||||
| CVE-2020-13873 | 1 Codologic | 1 Codoforum | 2021-05-20 | 10.0 HIGH | 9.8 CRITICAL |
| A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass the admin page via a leaked password-reset token of the admin. (As an admin, an attacker can upload a PHP shell and execute remote code on the operating system.) | |||||
| CVE-2020-22807 | 1 Vtiger | 1 Vtiger Crm | 2021-05-19 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature. | |||||
| CVE-2015-9244 | 1 Mysqljs | 1 Mysql | 2021-05-18 | 7.5 HIGH | 9.8 CRITICAL |
| Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection. | |||||
| CVE-2017-10816 | 1 Intercom | 1 Malion | 2021-05-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in the MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to execute arbitrary SQL commands via Relay Service Server. | |||||
| CVE-2019-18229 | 1 Advantech | 1 Wise-paas\/rmm | 2021-05-13 | 4.0 MEDIUM | 6.5 MEDIUM |
| Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information. | |||||