Total
14188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-35666 | 1 Steedos | 1 Steedos | 2020-12-23 | 6.5 MEDIUM | 8.8 HIGH |
| Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id[$ne]=1 value. | |||||
| CVE-2020-35276 | 1 Egavilanmedia | 1 Ecm Address Book | 2020-12-23 | 7.5 HIGH | 9.8 CRITICAL |
| EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user. | |||||
| CVE-2020-28070 | 1 Alumni Management System Project | 1 Alumni Management System | 2020-12-23 | 7.5 HIGH | 9.8 CRITICAL |
| SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_event.php via the 'id' parameter. | |||||
| CVE-2020-28073 | 1 Library Management System Project | 1 Library Management System | 2020-12-23 | 7.5 HIGH | 9.8 CRITICAL |
| SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on the system. | |||||
| CVE-2020-28074 | 1 Online Health Care System Project | 1 Online Health Care System | 2020-12-23 | 7.5 HIGH | 9.8 CRITICAL |
| SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass the authentication system and become an admin. | |||||
| CVE-2020-13968 | 1 Crk | 1 Business Platform | 2020-12-23 | 7.5 HIGH | 9.8 CRITICAL |
| CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parameter. | |||||
| CVE-2020-11717 | 1 Bilanc | 1 Bilanc | 2020-12-22 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities. | |||||
| CVE-2020-21377 | 1 Yunyecms | 1 Yunyecms | 2020-12-22 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter. | |||||
| CVE-2020-21378 | 1 Seacms | 1 Seacms | 2020-12-22 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php. | |||||
| CVE-2020-20300 | 1 Weiphp | 1 Weiphp | 2020-12-22 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in the wp_where function in WeiPHP 5.0. | |||||
| CVE-2020-35545 | 1 Spotweb Project | 1 Spotweb | 2020-12-21 | 7.5 HIGH | 9.8 CRITICAL |
| Time-based SQL injection exists in Spotweb 1.4.9 via the query string. | |||||
| CVE-2020-35122 | 1 Keysight | 1 Keysight Database Connector | 2020-12-17 | 4.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could bypass the access controls for using a saved database connection profile to submit arbitrary SQL against a saved database connection. | |||||
| CVE-2020-16104 | 1 Gallagher | 1 Command Centre | 2020-12-16 | 6.5 MEDIUM | 7.2 HIGH |
| SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); 8.00 versions prior to 8.00.1228(MR6); version 7.90 and prior versions. | |||||
| CVE-2020-25889 | 1 Online Bus Booking System Project | 1 Online Bus Booking System | 2020-12-15 | 7.5 HIGH | 9.8 CRITICAL |
| Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege. | |||||
| CVE-2020-28860 | 1 Openasset | 1 Digital Asset Management | 2020-12-15 | 6.5 MEDIUM | 8.8 HIGH |
| OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection. | |||||
| CVE-2020-20189 | 1 Newpk Project | 1 Newpk | 2020-12-15 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in NewPK 1.1 via the title parameter to admin\newpost.php. | |||||
| CVE-2019-19286 | 1 Siemens | 1 Xhq | 2020-12-15 | 6.5 MEDIUM | 7.2 HIGH |
| A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow SQL injection attacks if an attacker is able to modify content of particular web pages. | |||||
| CVE-2020-35382 | 1 Classroombookings | 1 Classroombookings | 2020-12-14 | 6.5 MEDIUM | 7.2 HIGH |
| SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user. | |||||
| CVE-2020-35378 | 1 Online Bus Ticket Reservation Project | 1 Online Bus Ticket Reservation | 2020-12-14 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields. | |||||
| CVE-2020-19165 | 1 Phpshe | 1 Phpshe | 2020-12-14 | 7.5 HIGH | 9.8 CRITICAL |
| PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevel_id=1 userlevel_id[] parameter. | |||||