CWE-89 · SQL Injection (page 90)
Page 90 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6898 | High | 7.3 | 2024-07-19 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file index.ph… |
CVE-2024-0857 | Critical | 9.8 | 2024-07-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Managem… |
CVE-2024-39911 | Critical | 10.0 | 2024-07-18 | 1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addresse… |
CVE-2024-39907 | Critical | 9.8 | 2024-07-18 | 1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to a… |
CVE-2024-40402 | Medium | 6.3 | 2024-07-17 | A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user i… |
CVE-2024-6830 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the f… |
CVE-2024-6808 | High | 7.3 | 2024-07-17 | A vulnerability was found in itsourcecode Simple Task List 1.0. It has been classified as critical. This affects the function insertUserRecord of the file sign… |
CVE-2024-6803 | Medium | 5.5 | 2024-07-17 | A vulnerability has been found in itsourcecode Document Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2024-6802 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, was found in SourceCodester Computer Laboratory Management System 1.0. Affected is an unknown function of th… |
CVE-2024-40637 | Medium | 4.2 | 2024-07-16 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user install… |
CVE-2024-40456 | Critical | 9.8 | 2024-07-16 | ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php. |
CVE-2024-40393 | Critical | 9.8 | 2024-07-16 | Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php. |
CVE-2024-40392 | Critical | 9.8 | 2024-07-16 | SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injecti… |
CVE-2024-40322 | High | 8.8 | 2024-07-16 | An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data |
CVE-2024-6457 | Critical | 9.8 | 2024-07-16 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all… |
CVE-2024-39887 | Medium | 4.3 | 2024-07-16 | An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-… |
CVE-2023-52290 | High | 8.1 | 2024-07-16 | In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the… |
CVE-2024-40560 | High | 7.3 | 2024-07-15 | Tmall_demo before v2024.07.03 was discovered to contain a SQL injection vulnerability. |
CVE-2024-6745 | High | 7.3 | 2024-07-15 | A vulnerability classified as critical has been found in code-projects Simple Ticket Booking 1.0. Affected is an unknown function of the file adminauthenticate… |
CVE-2024-6743 | Critical | 9.8 | 2024-07-15 | AguardNet's Space Management System does not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read… |
CVE-2024-6736 | Medium | 6.3 | 2024-07-15 | A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown p… |
CVE-2024-6735 | Medium | 6.3 | 2024-07-15 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-6734 | Medium | 6.3 | 2024-07-15 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file templat… |
CVE-2024-6733 | Medium | 6.3 | 2024-07-14 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2024-6732 | Medium | 6.3 | 2024-07-14 | A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. This vulnerability affects unknown code of… |
CVE-2024-6731 | Medium | 6.3 | 2024-07-14 | A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. This affects an unknown part of the fi… |
CVE-2024-6729 | Medium | 6.3 | 2024-07-14 | A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been declared as critical. This vulnerability affects unk… |
CVE-2024-6728 | Medium | 6.3 | 2024-07-14 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file typeedi… |
CVE-2024-40542 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/role?offset. |
CVE-2024-40541 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept/build. |
CVE-2024-40540 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept. |
CVE-2024-40539 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user. |
CVE-2024-39909 | Medium | 6.5 | 2024-07-12 | KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean… |
CVE-2024-37933 | Critical | 9.3 | 2024-07-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anhvnit Woocommerce OpenPos.This issue affects Woocommerc… |
CVE-2024-37564 | High | 8.5 | 2024-07-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PayPlus LTD PayPlus Payment Gateway.This issue affects Pa… |
CVE-2024-5325 | High | 8.8 | 2024-07-12 | The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, 1.4.10 due to insuf… |
CVE-2024-6353 | High | 8.8 | 2024-07-12 | The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'search[value]' parameter in all versions up to, and including, 1.5.4 du… |
CVE-2024-6681 | Medium | 6.3 | 2024-07-11 | A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this issue is some unknown func… |
CVE-2024-6680 | Medium | 6.3 | 2024-07-11 | A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-6679 | Medium | 6.3 | 2024-07-11 | A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role… |
CVE-2024-6666 | High | 8.8 | 2024-07-11 | The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and including, 1.13.0 due to i… |
CVE-2024-22280 | High | 8.5 | 2024-07-11 | VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter speci… |
CVE-2024-6676 | Medium | 6.3 | 2024-07-11 | A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-6653 | High | 7.3 | 2024-07-11 | A vulnerability was found in code-projects Simple Task List 1.0. It has been declared as critical. This vulnerability affects unknown code of the file loginFor… |
CVE-2024-6652 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file manage_member… |
CVE-2024-37148 | High | 8.1 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-5792 | High | 8.8 | 2024-07-10 | The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belong_to’ parameter in all versions up to, and including, 1.4.2 d… |
CVE-2024-39072 | Medium | 5.5 | 2024-07-09 | AMTT Hotel Broadband Operation System (HiBOS) v3.0.3.151204 is vulnerable to SQL injection via manager/conference/calendar_remind.php. |
CVE-2024-37873 | Critical | 9.8 | 2024-07-09 | SQL injection vulnerability in view_payslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remote attackers to execut… |
CVE-2024-37872 | High | 8.1 | 2024-07-09 | SQL injection vulnerability in process.php in Itsourcecode Billing System in PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the username… |
CVE-2024-37871 | High | 8.2 | 2024-07-09 | SQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackers to execute arbitra… |
CVE-2024-37870 | Critical | 9.8 | 2024-07-09 | SQL injection vulnerability in processscore.php in Learning Management System Project In PHP With Source Code 1.0 allows attackers to execute arbitrary SQL com… |
CVE-2024-6527 | | 2024-07-09 | SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and o… | |
CVE-2024-37090 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThe… |
CVE-2024-3604 | Critical | 9.9 | 2024-07-09 | The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode in all versions up… |
CVE-2024-37494 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a th… |
CVE-2024-37486 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships… |
CVE-2024-37256 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |
CVE-2024-37225 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketi… |
CVE-2024-37112 | Critical | 10.0 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects… |
CVE-2024-6166 | High | 8.8 | 2024-07-09 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ pa… |
CVE-2024-5793 | High | 8.8 | 2024-07-09 | The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3… |
CVE-2024-39677 | Medium | 5.9 | 2024-07-08 | NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLStrin… |
CVE-2024-40614 | Critical | 9.8 | 2024-07-07 | EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort… |
CVE-2024-5753 | High | 7.5 | 2024-07-05 | vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticate… |
CVE-2024-27709 | Critical | 9.8 | 2024-07-05 | SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of the allstudents.php c… |
CVE-2024-39027 | High | 7.5 | 2024-07-05 | SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer… |
CVE-2024-6471 | Medium | 6.3 | 2024-07-03 | A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management 1.0. This affects an unknown part of the file sms_set… |
CVE-2024-6453 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in itsourcecode Farm Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2024-6452 | Medium | 6.3 | 2024-07-02 | A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file Adm… |
CVE-2024-6440 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-6438 | Medium | 6.3 | 2024-07-02 | A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The… |
CVE-2024-6172 | Critical | 9.8 | 2024-07-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-base… |
CVE-2024-5606 | High | 8.8 | 2024-07-02 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_que… |
CVE-2024-39309 | Critical | 9.8 | 2024-07-01 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 al… |
CVE-2024-37765 | High | 8.8 | 2024-07-01 | Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. |
CVE-2024-6419 | Medium | 6.3 | 2024-07-01 | A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Ma… |
CVE-2024-6418 | High | 7.3 | 2024-06-30 | A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.ph… |
CVE-2024-6417 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2024-6416 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/d… |
CVE-2024-2386 | High | 8.8 | 2024-06-29 | The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all ve… |
CVE-2024-6265 | Critical | 9.8 | 2024-06-29 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based S… |
CVE-2024-5827 | Critical | 9.8 | 2024-06-28 | Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and gener… |
CVE-2024-3816 | Critical | 9.8 | 2024-06-28 | Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to a blind SQL Injection executed using the search bar. Only a part of observed services is… |
CVE-2024-1153 | Medium | 4.6 | 2024-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrect… |
CVE-2024-6372 | Medium | 6.3 | 2024-06-27 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file customer… |
CVE-2024-6371 | High | 7.3 | 2024-06-27 | A vulnerability, which was classified as critical, has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. Affected by this issue is som… |
CVE-2024-1839 | Critical | 10.0 | 2024-06-26 | Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker… |
CVE-2024-4228 | Critical | 9.8 | 2024-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, C… |
CVE-2024-37252 | Critical | 9.3 | 2024-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Icegram Email Subscribers & Newsletters allows SQL Inject… |
CVE-2024-29174 | Medium | 4.4 | 2024-06-26 | Dell Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.30, LTS 7.10.1.20 contain an SQL Injection vulnerability. A local low privileged attacker could potenti… |
CVE-2024-37843 | Critical | 9.8 | 2024-06-25 | Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. |
CVE-2024-5276 | Critical | 9.8 | 2024-06-25 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative… |
CVE-2024-6308 | High | 7.3 | 2024-06-25 | A vulnerability was found in itsourcecode Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code… |
CVE-2024-6028 | Critical | 9.8 | 2024-06-25 | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 d… |
CVE-2024-36683 | High | 7.3 | 2024-06-24 | SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive… |
CVE-2024-36681 | Critical | 9.8 | 2024-06-24 | SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and c… |
CVE-2024-34992 | High | 8.8 | 2024-06-24 | SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allow… |
CVE-2024-34988 | Critical | 9.8 | 2024-06-24 | SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop… |
CVE-2024-6160 | | 2024-06-24 | SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages… |