CWE-89 · SQL Injection (page 83)
Page 83 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37090 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThe… |
CVE-2024-3604 | Critical | 9.9 | 2024-07-09 | The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode in all versions up… |
CVE-2024-37494 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a th… |
CVE-2024-37486 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships… |
CVE-2024-37256 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |
CVE-2024-37225 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketi… |
CVE-2024-37112 | Critical | 10.0 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects… |
CVE-2024-6166 | High | 8.8 | 2024-07-09 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ pa… |
CVE-2024-5793 | High | 8.8 | 2024-07-09 | The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3… |
CVE-2024-39677 | Medium | 5.9 | 2024-07-08 | NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLStrin… |
CVE-2024-40614 | Critical | 9.8 | 2024-07-07 | EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort… |
CVE-2024-5753 | High | 7.5 | 2024-07-05 | vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticate… |
CVE-2024-27709 | Critical | 9.8 | 2024-07-05 | SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of the allstudents.php c… |
CVE-2024-39027 | High | 7.5 | 2024-07-05 | SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer… |
CVE-2024-6471 | Medium | 6.3 | 2024-07-03 | A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management 1.0. This affects an unknown part of the file sms_set… |
CVE-2024-6453 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in itsourcecode Farm Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2024-6452 | Medium | 6.3 | 2024-07-02 | A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file Adm… |
CVE-2024-6440 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-6438 | Medium | 6.3 | 2024-07-02 | A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The… |
CVE-2024-6172 | Critical | 9.8 | 2024-07-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-base… |
CVE-2024-5606 | High | 8.8 | 2024-07-02 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_que… |
CVE-2024-39309 | Critical | 9.8 | 2024-07-01 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 al… |
CVE-2024-37765 | High | 8.8 | 2024-07-01 | Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. |
CVE-2024-6419 | Medium | 6.3 | 2024-07-01 | A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Ma… |
CVE-2024-6418 | High | 7.3 | 2024-06-30 | A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.ph… |
CVE-2024-6417 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2024-6416 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/d… |
CVE-2024-2386 | High | 8.8 | 2024-06-29 | The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all ve… |
CVE-2024-6265 | Critical | 9.8 | 2024-06-29 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based S… |
CVE-2024-5827 | Critical | 9.8 | 2024-06-28 | Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and gener… |
CVE-2024-3816 | Critical | 9.8 | 2024-06-28 | Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to a blind SQL Injection executed using the search bar. Only a part of observed services is… |
CVE-2024-1153 | Medium | 4.6 | 2024-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrect… |
CVE-2024-6372 | Medium | 6.3 | 2024-06-27 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file customer… |
CVE-2024-6371 | High | 7.3 | 2024-06-27 | A vulnerability, which was classified as critical, has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. Affected by this issue is som… |
CVE-2024-1839 | Critical | 10.0 | 2024-06-26 | Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker… |
CVE-2024-4228 | Critical | 9.8 | 2024-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, C… |
CVE-2024-37252 | Critical | 9.3 | 2024-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Icegram Email Subscribers & Newsletters allows SQL Inject… |
CVE-2024-29174 | Medium | 4.4 | 2024-06-26 | Dell Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.30, LTS 7.10.1.20 contain an SQL Injection vulnerability. A local low privileged attacker could potenti… |
CVE-2024-37843 | Critical | 9.8 | 2024-06-25 | Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. |
CVE-2024-5276 | Critical | 9.8 | 2024-06-25 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative… |
CVE-2024-6308 | High | 7.3 | 2024-06-25 | A vulnerability was found in itsourcecode Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code… |
CVE-2024-6028 | Critical | 9.8 | 2024-06-25 | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 d… |
CVE-2024-36683 | High | 7.3 | 2024-06-24 | SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive… |
CVE-2024-36681 | Critical | 9.8 | 2024-06-24 | SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and c… |
CVE-2024-34992 | High | 8.8 | 2024-06-24 | SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allow… |
CVE-2024-34988 | Critical | 9.8 | 2024-06-24 | SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop… |
CVE-2024-6160 | | 2024-06-24 | SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages… | |
CVE-2024-6279 | Medium | 6.3 | 2024-06-24 | A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this issue is some unknown functionali… |
CVE-2024-6278 | Medium | 4.7 | 2024-06-24 | A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-6277 | Medium | 4.7 | 2024-06-24 | A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Affected is an unknown function of the fil… |
CVE-2024-6276 | Medium | 4.7 | 2024-06-24 | A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. This issue affects some unknown proce… |
CVE-2024-6275 | Medium | 4.7 | 2024-06-24 | A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. This vulnerability affects unknown code of the file pa… |
CVE-2024-6274 | Medium | 4.7 | 2024-06-24 | A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. This affects an unknown part of the file /attenda… |
CVE-2024-6268 | High | 7.3 | 2024-06-23 | A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Affected by this issue is some unknow… |
CVE-2024-6266 | Medium | 6.3 | 2024-06-23 | A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2. Affected is an unknown function of the file /system/dictData/loadDictItem… |
CVE-2024-6253 | High | 7.3 | 2024-06-22 | A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2024-21514 | High | 7.4 | 2024-06-22 | This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is… |
CVE-2024-34989 | Critical | 9.8 | 2024-06-21 | In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFProductListModuleFro… |
CVE-2024-6241 | Medium | 6.3 | 2024-06-21 | A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/… |
CVE-2024-6027 | Critical | 9.8 | 2024-06-21 | The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, a… |
CVE-2024-5756 | Critical | 9.8 | 2024-06-21 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-base… |
CVE-2024-6218 | High | 7.3 | 2024-06-21 | A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. Affected by this issue is some unknown functio… |
CVE-2024-6217 | Medium | 6.3 | 2024-06-21 | A vulnerability classified as critical was found in SourceCodester Food Ordering Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-6216 | Medium | 6.3 | 2024-06-21 | A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file add-us… |
CVE-2024-6215 | Medium | 6.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been rated as critical. This issue affects some unknown processin… |
CVE-2024-6214 | Medium | 6.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2024-6213 | High | 7.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2024-6212 | Low | 3.5 | 2024-06-21 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. Affected by this issue is the function get_stud… |
CVE-2024-29390 | High | 7.3 | 2024-06-20 | Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page… |
CVE-2024-37699 | Critical | 9.8 | 2024-06-20 | An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption. |
CVE-2024-6196 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-6195 | Medium | 6.3 | 2024-06-20 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-6194 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file editm… |
CVE-2024-6193 | High | 7.3 | 2024-06-20 | A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. This issue affects some unknown processing of… |
CVE-2024-6192 | High | 7.3 | 2024-06-20 | A vulnerability classified as critical was found in itsourcecode Loan Management System 1.0. This vulnerability affects unknown code of the file login.php of t… |
CVE-2024-6191 | High | 7.3 | 2024-06-20 | A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. This affects an unknown part of the file login.php of the… |
CVE-2024-6190 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Farm Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2024-6113 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Monbela Tourist Inn Online Reservation System 1.0. It has been rated as critical. This issue affects some unknown pro… |
CVE-2024-5522 | Medium | 6.5 | 2024-06-20 | The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing… |
CVE-2024-5605 | High | 8.8 | 2024-06-20 | The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all… |
CVE-2024-4742 | Medium | 6.5 | 2024-06-20 | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the… |
CVE-2024-3605 | Critical | 10.0 | 2024-06-20 | The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in… |
CVE-2024-3561 | High | 8.8 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and including, 2.6.7 due to i… |
CVE-2024-36684 | Critical | 9.8 | 2024-06-19 | In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive S… |
CVE-2024-36680 | High | 7.5 | 2024-06-19 | In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a se… |
CVE-2024-36678 | Critical | 9.8 | 2024-06-19 | In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensi… |
CVE-2024-34994 | Critical | 9.8 | 2024-06-19 | In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontControl… |
CVE-2024-34993 | Medium | 6.3 | 2024-06-19 | In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can per… |
CVE-2024-37791 | Medium | 6.0 | 2024-06-18 | DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id. |
CVE-2024-38348 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Staff Info module via the searvalu para… |
CVE-2024-38347 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Room Information module via the id para… |
CVE-2024-37802 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Patient Info module via the searvalu pa… |
CVE-2024-37799 | Medium | 5.4 | 2024-06-18 | CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_reservations.php. |
CVE-2024-6112 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical was found in itsourcecode Pool of Bethesda Online Reservation System 1.0. This vulnerability affects unknown code of the… |
CVE-2024-6111 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. This affects an unknown part of the file… |
CVE-2024-6109 | Medium | 6.3 | 2024-06-18 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-6067 | Medium | 6.3 | 2024-06-17 | A vulnerability classified as critical was found in SourceCodester Music Class Enrollment System 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-6066 | Medium | 6.3 | 2024-06-17 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file pa… |
CVE-2024-6065 | High | 7.3 | 2024-06-17 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2024-37896 | High | 8.8 | 2024-06-17 | Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.6.5 has SQL injection vulnerability. The SQL injection vulnerabilities… |