Total
14188 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-8421 | 1 Bagesoft | 1 Bagecms | 2019-02-20 | 6.5 MEDIUM | 7.2 HIGH |
| upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter. | |||||
| CVE-2019-8393 | 1 Hotels Server Project | 1 Hotels Server | 2019-02-20 | 7.5 HIGH | 9.8 CRITICAL |
| Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled. | |||||
| CVE-2019-8360 | 1 Themerig | 1 Find A Place Cms Directory | 2019-02-20 | 7.5 HIGH | 9.8 CRITICAL |
| Themerig Find a Place CMS Directory 1.5 has SQL Injection via the find/assets/external/data_2.php cate parameter. | |||||
| CVE-2019-8422 | 1 Pbootcms | 1 Pbootcms | 2019-02-19 | 6.5 MEDIUM | 7.2 HIGH |
| A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php. | |||||
| CVE-2019-8423 | 1 Zoneminder | 1 Zoneminder | 2019-02-19 | 7.5 HIGH | 9.8 CRITICAL |
| ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter. | |||||
| CVE-2019-8424 | 1 Zoneminder | 1 Zoneminder | 2019-02-19 | 7.5 HIGH | 9.8 CRITICAL |
| ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter. | |||||
| CVE-2019-8429 | 1 Zoneminder | 1 Zoneminder | 2019-02-19 | 7.5 HIGH | 9.8 CRITICAL |
| ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter. | |||||
| CVE-2019-8428 | 1 Zoneminder | 1 Zoneminder | 2019-02-19 | 7.5 HIGH | 9.8 CRITICAL |
| ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value. | |||||
| CVE-2015-4615 | 1 Easy2map | 1 Easy2map-photos | 2019-02-19 | 7.5 HIGH | 9.8 CRITICAL |
| Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables | |||||
| CVE-2019-5488 | 1 Earclink | 1 Espcms-p8 | 2019-02-14 | 5.0 MEDIUM | 7.5 HIGH |
| EARCLINK ESPCMS-P8 has SQL injection in the install_pack/index.php?ac=Member&at=verifyAccount verify_key parameter. install_pack/espcms_public/espcms_db.php may allow retrieving sensitive information from the ESPCMS database. | |||||
| CVE-2019-3576 | 1 Inxedu Project | 1 Inxedu | 2019-02-14 | 7.5 HIGH | 9.8 CRITICAL |
| inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATH_INFO. The vulnerable code location is com.inxedu.os.edu.controller.user.UserController#deleteFavorite (aka deleteFavorite in com/inxedu/os/edu/controller/user/UserController.java), where courseFavoritesService.deleteCourseFavoritesById is mishandled during use of MyBatis. NOTE: UserController.java has a spelling variation in an annotation: a @RequestMapping("/deleteFaveorite/{ids}") line followed by a "public ModelAndView deleteFavorite" line. | |||||
| CVE-2019-3577 | 1 Bijiadao | 1 Waimai Super Cms | 2019-02-14 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/ProductAction.class.php allows blind SQL Injection via the id[0] parameter to the /product URI. | |||||
| CVE-2015-7999 | 1 Citrix | 1 Command Center | 2019-02-13 | 6.5 MEDIUM | 8.1 HIGH |
| Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | |||||
| CVE-2018-20770 | 1 Xerox | 58 Workcentre 3655, Workcentre 3655 Firmware, Workcentre 3655i and 55 more | 2019-02-13 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is Blind SQL Injection. | |||||
| CVE-2018-20779 | 1 Traq | 1 Traq | 2019-02-11 | 7.5 HIGH | 9.8 CRITICAL |
| Traq 3.7.1 allows SQL Injection via a tickets?search= URI. | |||||
| CVE-2018-16188 | 1 Ricoh | 16 D2200, D2200 Firmware, D5500 and 13 more | 2019-02-08 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | |||||
| CVE-2019-7587 | 1 Bo-blog | 1 Bw | 2019-02-08 | 7.5 HIGH | 9.8 CRITICAL |
| Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function. | |||||
| CVE-2019-7585 | 1 Bijiadao | 1 Waimai Super Cms | 2019-02-08 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI. | |||||
| CVE-2019-7568 | 1 Baijiacms Project | 1 Baijiacms | 2019-02-07 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request. | |||||
| CVE-2019-6523 | 1 Advantech | 1 Webaccess\/scada | 2019-02-06 | 7.5 HIGH | 9.8 CRITICAL |
| WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands. | |||||