CWE-89 · SQL Injection (page 87)
Page 87 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4794 | Medium | 6.3 | 2024-05-14 | A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-4793 | Medium | 6.3 | 2024-05-14 | A vulnerability, which was classified as critical, was found in Campcodes Online Laundry Management System 1.0. Affected is an unknown function of the file /ma… |
CVE-2024-4792 | Medium | 6.3 | 2024-05-14 | A vulnerability, which was classified as critical, has been found in Campcodes Online Laundry Management System 1.0. This issue affects some unknown processing… |
CVE-2024-4434 | Critical | 9.8 | 2024-05-14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and includi… |
CVE-2024-4423 | High | 7.2 | 2024-05-14 | The access control in CemiPark software does not properly validate user-entered data, which allows the authentication bypass. An attacker who has network acces… |
CVE-2024-3055 | High | 8.8 | 2024-05-14 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in… |
CVE-2024-34310 | High | 8.8 | 2024-05-14 | Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter. |
CVE-2024-34226 | Critical | 9.4 | 2024-05-14 | SQL injection vulnerability in /php-sqlite-vms/?page=manage_visitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary S… |
CVE-2024-34222 | Medium | 5.9 | 2024-05-14 | Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the searccountry parameter. |
CVE-2024-34220 | High | 7.5 | 2024-05-14 | Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter. |
CVE-2024-32739 | High | 7.5 | 2024-05-14 | A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via… |
CVE-2024-32738 | High | 7.5 | 2024-05-14 | A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via… |
CVE-2024-32737 | High | 7.5 | 2024-05-14 | A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via… |
CVE-2024-32736 | High | 7.5 | 2024-05-14 | A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via… |
CVE-2024-32655 | High | 8.1 | 2024-05-14 | Npgsql is the .NET data provider for PostgreSQL. The `WriteBind()` method in `src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs` uses `int` variables to… |
CVE-2024-31460 | Medium | 6.5 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is not… |
CVE-2024-31458 | Medium | 4.6 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in `graph_t… |
CVE-2024-31445 | High | 8.8 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_s… |
CVE-2024-30801 | Medium | 5.5 | 2024-05-14 | SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code via a crafted payload… |
CVE-2024-28279 | High | 7.3 | 2024-05-14 | Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=. |
CVE-2023-50718 | Medium | 6.5 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injectio… |
CVE-2023-29881 | Medium | 6.5 | 2024-05-14 | phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php. |
CVE-2024-25533 | Critical | 9.4 | 2024-05-08 | Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). This vulnerability can a… |
CVE-2024-25532 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx. |
CVE-2024-25528 | Medium | 5.9 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx. |
CVE-2024-31961 | Critical | 9.8 | 2024-05-08 | A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands via the level2 parame… |
CVE-2024-25531 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.aspx. |
CVE-2024-25530 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condiction.aspx. |
CVE-2024-25529 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_show.aspx. |
CVE-2024-25527 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx. |
CVE-2024-4654 | Medium | 6.3 | 2024-05-08 | A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /x… |
CVE-2024-4653 | Medium | 6.3 | 2024-05-08 | A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2024-26026 | High | 7.5 | 2024-05-08 | An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS)… |
CVE-2024-25526 | High | 8.1 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_inc.aspx. |
CVE-2024-25525 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx. |
CVE-2024-25524 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.asp… |
CVE-2024-25523 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx. |
CVE-2024-25522 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_form_save.aspx. |
CVE-2024-25521 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx. |
CVE-2024-25520 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.aspx. |
CVE-2024-25519 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx. |
CVE-2024-25518 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_approve.aspx. |
CVE-2024-25517 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx. |
CVE-2024-25515 | High | 7.3 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work_finish_file_down.a… |
CVE-2024-21793 | High | 7.5 | 2024-05-08 | An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoT… |
CVE-2024-25514 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /SysManage/wf_template_child_field_list.aspx. |
CVE-2024-25513 | High | 7.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/kaizen_download.aspx. |
CVE-2024-25511 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_new.aspx. |
CVE-2024-25510 | Critical | 9.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_show.aspx. |
CVE-2024-25509 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx. |
CVE-2024-25512 | High | 8.1 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter at /Bulletin/AttachDownLoad.aspx. |
CVE-2024-25508 | Critical | 9.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin_template_show.aspx. |
CVE-2024-25507 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.aspx. |
CVE-2024-33164 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function. |
CVE-2024-33161 | Medium | 5.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function. |
CVE-2024-33155 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function. |
CVE-2024-33153 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function. |
CVE-2024-33149 | High | 8.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function. |
CVE-2024-33148 | High | 7.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function. |
CVE-2024-33147 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function. |
CVE-2024-33146 | Critical | 9.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function. |
CVE-2024-33144 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. |
CVE-2024-33139 | High | 7.5 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function. |
CVE-2024-4595 | Medium | 6.3 | 2024-05-07 | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php… |
CVE-2024-33124 | Critical | 9.8 | 2024-05-07 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function.. |
CVE-2024-33122 | Medium | 6.3 | 2024-05-07 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function. |
CVE-2024-32369 | Medium | 4.3 | 2024-05-07 | SQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafte… |
CVE-2024-31456 | High | 7.7 | 2024-05-07 | GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. Thi… |
CVE-2024-29889 | High | 7.1 | 2024-05-07 | GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searche… |
CVE-2024-34534 | High | 7.3 | 2024-05-06 | A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain priv… |
CVE-2024-34533 | High | 7.3 | 2024-05-06 | A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a remote attacker to… |
CVE-2024-34532 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker to gain privileges… |
CVE-2024-33121 | Medium | 6.3 | 2024-05-06 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function. |
CVE-2024-34412 | High | 8.5 | 2024-05-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Parcel Panel ParcelPanel.This issue affects ParcelPanel… |
CVE-2024-34386 | High | 7.6 | 2024-05-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lucian Apostol Auto Affiliate Links.This issue affects Au… |
CVE-2024-33411 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_admin_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary… |
CVE-2024-33410 | High | 8.1 | 2024-05-06 | SQL injection vulnerability in /model/delete_range_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary… |
CVE-2024-33409 | Critical | 9.8 | 2024-05-06 | SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the… |
CVE-2024-33408 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL… |
CVE-2024-33407 | Medium | 5.9 | 2024-05-06 | SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL c… |
CVE-2024-33406 | High | 7.3 | 2024-05-06 | SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute… |
CVE-2024-33405 | High | 8.6 | 2024-05-06 | SQL injection vulnerability in add_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands v… |
CVE-2024-33404 | High | 8.3 | 2024-05-06 | A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute a… |
CVE-2024-33403 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL co… |
CVE-2024-34472 | Medium | 5.5 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliRealtimeEmails.php… |
CVE-2024-4548 | Critical | 9.8 | 2024-05-06 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into… |
CVE-2024-4547 | Critical | 9.8 | 2024-05-06 | A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted int… |
CVE-2021-20451 | Medium | 6.0 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could all… |
CVE-2024-31673 | Critical | 9.8 | 2024-05-03 | Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data.php via the userid parameter. |
CVE-2023-38724 | Medium | 6.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could all… |
CVE-2024-33787 | High | 8.2 | 2024-05-03 | Hengan Weighing Management Information Query Platform 2019-2021 53.25 was discovered to contain a SQL injection vulnerability via the tuser_Number parameter at… |
CVE-2024-4466 | Critical | 9.8 | 2024-05-03 | SQL injection vulnerability in Gescen on the centrosdigitales.net platform. This vulnerability allows an attacker to send a specially crafted SQL query to the… |
CVE-2023-51595 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2023-51586 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower Pro selectEventConfig SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2023-44450 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2023-44449 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escal… |
CVE-2023-38100 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escal… |
CVE-2023-38099 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2023-35720 | Medium | 6.5 | 2024-05-03 | ASUS RT-AX92U lighttpd mod_webdav.so SQL Injection Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensi… |
CVE-2023-27358 | High | 8.8 | 2024-05-03 | NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |