CWE-89 · SQL Injection (page 72)
Page 72 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53900 | Critical | 9.1 | 2024-12-02 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. |
CVE-2024-52724 | Critical | 9.8 | 2024-12-02 | ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php. |
CVE-2024-53364 | Medium | 5.4 | 2024-12-02 | A SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. This vulnerability affects the viewid… |
CVE-2024-46908 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46907 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46906 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46905 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated lower-privileged user (at least Network Manager permis… |
CVE-2024-53792 | High | 8.5 | 2024-12-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affect… |
CVE-2024-12015 | High | 7.7 | 2024-12-02 | The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route. |
CVE-2024-12007 | Medium | 6.3 | 2024-12-01 | A vulnerability, which was classified as critical, was found in code-projects Farmacia 1.0. This affects an unknown part of the file /visualizar-produto.php. T… |
CVE-2024-53783 | High | 7.6 | 2024-11-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-c… |
CVE-2024-11998 | Medium | 6.3 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /visualizer-forn… |
CVE-2024-53507 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. |
CVE-2024-53506 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. |
CVE-2024-53505 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. |
CVE-2024-53504 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. |
CVE-2024-11970 | High | 7.3 | 2024-11-28 | A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function of the file /tour(co… |
CVE-2024-11968 | Medium | 6.3 | 2024-11-28 | A vulnerability was found in code-projects Farmacia up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-11967 | High | 7.3 | 2024-11-28 | A vulnerability was found in PHPGurukul Complaint Management system 1.0. It has been classified as critical. Affected is an unknown function of the file /admin… |
CVE-2024-11966 | High | 7.3 | 2024-11-28 | A vulnerability was found in PHPGurukul Complaint Management system 1.0 and classified as critical. This issue affects some unknown processing of the file /adm… |
CVE-2024-11965 | High | 7.3 | 2024-11-28 | A vulnerability has been found in PHPGurukul Complaint Management system 1.0 and classified as critical. This vulnerability affects unknown code of the file /u… |
CVE-2024-11964 | High | 7.3 | 2024-11-28 | A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management system 1.0. This affects an unknown part of the file /user/inde… |
CVE-2024-11963 | Medium | 6.3 | 2024-11-28 | A vulnerability, which was classified as critical, has been found in code-projects Responsive Hotel Site 1.0. Affected by this issue is some unknown functional… |
CVE-2024-11962 | High | 7.3 | 2024-11-28 | A vulnerability classified as critical was found in code-projects Simple Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-8308 | Medium | 6.5 | 2024-11-28 | A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltra… |
CVE-2024-52495 | High | 8.5 | 2024-11-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Distance Based Shipping Calculator dist… |
CVE-2024-52474 | Critical | 9.3 | 2024-11-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Сервис “Экспресс Платежи” Express Payments Module express… |
CVE-2024-53603 | High | 7.3 | 2024-11-27 | A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attacker… |
CVE-2024-42327 | Critical | 9.9 | 2024-11-27 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQL… |
CVE-2024-11009 | Medium | 4.9 | 2024-11-27 | The Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘p… |
CVE-2024-11025 | Medium | 5.4 | 2024-11-27 | An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access… |
CVE-2024-11819 | High | 7.3 | 2024-11-27 | A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /for… |
CVE-2024-11818 | High | 7.3 | 2024-11-27 | A vulnerability classified as critical has been found in PHPGurukul User Registration & Login and User Management System 1.0. This affects an unknown part of t… |
CVE-2024-11817 | High | 7.3 | 2024-11-26 | A vulnerability was found in PHPGurukul User Registration & Login and User Management System 1.0. It has been rated as critical. Affected by this issue is some… |
CVE-2024-50942 | Critical | 9.8 | 2024-11-26 | qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml. |
CVE-2024-11744 | High | 7.3 | 2024-11-26 | A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-10570 | High | 7.5 | 2024-11-26 | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofi… |
CVE-2024-53597 | Medium | 6.3 | 2024-11-25 | masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit. |
CVE-2024-50672 | Critical | 9.8 | 2024-11-25 | A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passw… |
CVE-2024-45756 | High | 7.2 | 2024-11-25 | An issue was discovered in Centreon centreon-open-tickets 24.10.x before 24.10.0, 24.04.x before 24.04.2, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 2… |
CVE-2024-45755 | High | 7.2 | 2024-11-25 | An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 22… |
CVE-2024-11663 | High | 7.3 | 2024-11-25 | A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file search… |
CVE-2024-11649 | High | 7.3 | 2024-11-25 | A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-11648 | High | 7.3 | 2024-11-25 | A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /a… |
CVE-2024-11647 | High | 7.3 | 2024-11-25 | A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown… |
CVE-2024-11646 | High | 7.3 | 2024-11-25 | A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-11632 | High | 7.3 | 2024-11-23 | A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file /book_… |
CVE-2023-7299 | Medium | 6.3 | 2024-11-23 | A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. Th… |
CVE-2024-11631 | Medium | 6.3 | 2024-11-23 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /e… |
CVE-2024-8355 | Medium | 6.8 | 2024-11-22 | Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability. This vulnerability allows physically present attackers to execute arbi… |
CVE-2023-52335 | High | 7.5 | 2024-11-22 | Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2024-53438 | Critical | 9.8 | 2024-11-22 | EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which… |
CVE-2024-7882 | Medium | 6.5 | 2024-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-Commerce allows SQL I… |
CVE-2024-7837 | High | 8.2 | 2024-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Firmanet Software ERP allows SQL Injection. This issue a… |
CVE-2024-49588 | Medium | 6.8 | 2024-11-21 | Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections. |
CVE-2024-11592 | High | 7.3 | 2024-11-21 | A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-7026 | High | 7.5 | 2024-11-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informatics Closed Circuit Vehicle Tracking Soft… |
CVE-2024-11591 | High | 7.3 | 2024-11-21 | A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /a… |
CVE-2024-11590 | High | 7.3 | 2024-11-21 | A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown func… |
CVE-2024-11589 | Medium | 6.3 | 2024-11-21 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-9828 | Medium | 4.1 | 2024-11-21 | The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high priv… |
CVE-2024-10400 | High | 7.5 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insuffic… |
CVE-2024-52725 | Medium | 4.9 | 2024-11-20 | SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_Se… |
CVE-2024-11487 | Medium | 6.3 | 2024-11-20 | A vulnerability has been found in Code4Berry Decoration Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2024-11179 | Medium | 6.5 | 2024-11-20 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versi… |
CVE-2024-52360 | High | 7.6 | 2024-11-19 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which coul… |
CVE-2024-48072 | Critical | 9.8 | 2024-11-19 | Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.se… |
CVE-2024-52675 | Critical | 9.8 | 2024-11-19 | SourceCodester Sentiment Based Movie Rating System 1.0 is vulnerable to SQL Injection in /msrps/movies.php. |
CVE-2024-44756 | Critical | 9.8 | 2024-11-18 | NUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLogin. |
CVE-2024-52436 | High | 7.6 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection… |
CVE-2024-52435 | High | 7.6 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.Th… |
CVE-2024-52431 | Critical | 9.3 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressaholic WordPress Video Robot - The Ultimate Video Im… |
CVE-2024-3370 | High | 8.6 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egebilgi Software Website Template allows SQL Injection. … |
CVE-2024-49574 | High | 8.3 | 2024-11-18 | Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module. |
CVE-2024-11305 | Medium | 6.3 | 2024-11-18 | A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee… |
CVE-2024-9887 | High | 7.2 | 2024-11-16 | The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to… |
CVE-2024-10645 | High | 7.5 | 2024-11-16 | The Blogger 301 Redirect plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘br’ parameter in all versions up to, and including, 2.5… |
CVE-2024-11258 | High | 7.3 | 2024-11-15 | A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2024-11257 | High | 7.3 | 2024-11-15 | A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/fo… |
CVE-2024-11256 | High | 7.3 | 2024-11-15 | A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2024-45608 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17. |
CVE-2024-41679 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0… |
CVE-2024-40638 | High | 8.1 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to a… |
CVE-2024-11251 | Medium | 6.3 | 2024-11-15 | A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportCo… |
CVE-2024-11250 | Medium | 6.3 | 2024-11-15 | A vulnerability was found in code-projects Inventory Management up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2021-1470 | Medium | 4.9 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct SQL inject… |
CVE-2024-51164 | Critical | 9.1 | 2024-11-15 | Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially c… |
CVE-2024-50724 | Critical | 9.8 | 2024-11-15 | KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp. |
CVE-2024-11245 | Medium | 6.3 | 2024-11-15 | A vulnerability, which was classified as critical, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /editar… |
CVE-2024-11244 | Medium | 6.3 | 2024-11-15 | A vulnerability classified as critical was found in code-projects Farmacia 1.0. This vulnerability affects unknown code of the file /editar-cliente.php. The ma… |
CVE-2024-11242 | Medium | 4.7 | 2024-11-15 | A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ad_list.php?act… |
CVE-2024-11241 | High | 7.3 | 2024-11-15 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-50831 | High | 7.2 | 2024-11-14 | A SQL Injection was found in /admin/admin_user.php in kashipara E-learning Management System Project 1.0 via the username and password parameters. |
CVE-2024-50830 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Project 1.0 via the date_start, date_end, an… |
CVE-2024-50829 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_subject.php in kashipara E-learning Management System Project 1.0 via the unit parameter. |
CVE-2024-50828 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_department.php in kashipara E-learning Management System Project 1.0 via the d parameter. |
CVE-2024-50827 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/add_subject.php in kashipara E-learning Management System Project 1.0 via the subject_code parameter. |
CVE-2024-50826 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/add_content.php in kashipara E-learning Management System Project 1.0 via the title and content parameters. |
CVE-2024-50825 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/school_year.php in kashipara E-learning Management System Project 1.0 via the school_year parameter. |
CVE-2024-50824 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via the class_name parameter. |