CWE-89 · SQL Injection (page 95)
Page 95 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25511 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_new.aspx. |
CVE-2024-25510 | Critical | 9.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_show.aspx. |
CVE-2024-25509 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx. |
CVE-2024-25512 | High | 8.1 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter at /Bulletin/AttachDownLoad.aspx. |
CVE-2024-25508 | Critical | 9.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin_template_show.aspx. |
CVE-2024-25507 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.aspx. |
CVE-2024-33164 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function. |
CVE-2024-33161 | Medium | 5.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function. |
CVE-2024-33155 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function. |
CVE-2024-33153 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function. |
CVE-2024-33149 | High | 8.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function. |
CVE-2024-33148 | High | 7.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function. |
CVE-2024-33147 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function. |
CVE-2024-33146 | Critical | 9.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function. |
CVE-2024-33144 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. |
CVE-2024-33139 | High | 7.5 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function. |
CVE-2024-4595 | Medium | 6.3 | 2024-05-07 | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php… |
CVE-2024-33124 | Critical | 9.8 | 2024-05-07 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function.. |
CVE-2024-33122 | Medium | 6.3 | 2024-05-07 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function. |
CVE-2024-32369 | Medium | 4.3 | 2024-05-07 | SQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafte… |
CVE-2024-31456 | High | 7.7 | 2024-05-07 | GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. Thi… |
CVE-2024-29889 | High | 7.1 | 2024-05-07 | GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searche… |
CVE-2024-34534 | High | 7.3 | 2024-05-06 | A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain priv… |
CVE-2024-34533 | High | 7.3 | 2024-05-06 | A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a remote attacker to… |
CVE-2024-34532 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker to gain privileges… |
CVE-2024-33121 | Medium | 6.3 | 2024-05-06 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function. |
CVE-2024-34412 | High | 8.5 | 2024-05-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Parcel Panel ParcelPanel.This issue affects ParcelPanel… |
CVE-2024-34386 | High | 7.6 | 2024-05-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lucian Apostol Auto Affiliate Links.This issue affects Au… |
CVE-2024-33411 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_admin_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary… |
CVE-2024-33410 | High | 8.1 | 2024-05-06 | SQL injection vulnerability in /model/delete_range_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary… |
CVE-2024-33409 | Critical | 9.8 | 2024-05-06 | SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the… |
CVE-2024-33408 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL… |
CVE-2024-33407 | Medium | 5.9 | 2024-05-06 | SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL c… |
CVE-2024-33406 | High | 7.3 | 2024-05-06 | SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute… |
CVE-2024-33405 | High | 8.6 | 2024-05-06 | SQL injection vulnerability in add_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands v… |
CVE-2024-33404 | High | 8.3 | 2024-05-06 | A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute a… |
CVE-2024-33403 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL co… |
CVE-2024-34472 | Medium | 5.5 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliRealtimeEmails.php… |
CVE-2024-4548 | Critical | 9.8 | 2024-05-06 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into… |
CVE-2024-4547 | Critical | 9.8 | 2024-05-06 | A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted int… |
CVE-2021-20451 | Medium | 6.0 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could all… |
CVE-2024-31673 | Critical | 9.8 | 2024-05-03 | Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data.php via the userid parameter. |
CVE-2023-38724 | Medium | 6.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could all… |
CVE-2024-33787 | High | 8.2 | 2024-05-03 | Hengan Weighing Management Information Query Platform 2019-2021 53.25 was discovered to contain a SQL injection vulnerability via the tuser_Number parameter at… |
CVE-2024-4466 | Critical | 9.8 | 2024-05-03 | SQL injection vulnerability in Gescen on the centrosdigitales.net platform. This vulnerability allows an attacker to send a specially crafted SQL query to the… |
CVE-2023-51595 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2023-51586 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower Pro selectEventConfig SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2023-44450 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2023-44449 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escal… |
CVE-2023-38100 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escal… |
CVE-2023-38099 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2023-35720 | Medium | 6.5 | 2024-05-03 | ASUS RT-AX92U lighttpd mod_webdav.so SQL Injection Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensi… |
CVE-2023-27358 | High | 8.8 | 2024-05-03 | NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-34032 | High | 8.8 | 2024-05-03 | Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploi… |
CVE-2024-34031 | High | 8.8 | 2024-05-03 | Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit… |
CVE-2024-4215 | High | 7.4 | 2024-05-02 | pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’… |
CVE-2024-2876 | Critical | 9.8 | 2024-05-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injec… |
CVE-2024-2831 | High | 8.8 | 2024-05-02 | The Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcodes in all versions up to, and including, 1.3.14 due to insufficient e… |
CVE-2024-2661 | High | 8.8 | 2024-05-02 | The Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. plugin for WordPress is vulnerable to blind… |
CVE-2024-1797 | High | 8.8 | 2024-05-02 | The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to SQL Injection via the 'status' and 'id' attributes of the 'wp_ul… |
CVE-2024-1173 | High | 7.2 | 2024-05-02 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-33911 | High | 7.6 | 2024-05-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar School Management Pro.This issue affects School… |
CVE-2024-33292 | High | 8.2 | 2024-05-01 | SQL Injection vulnerability in Realisation MGSD v.1.0 allows a remote attacker to obtain sensitive information via the id parameter. |
CVE-2024-32212 | High | 8.1 | 2024-05-01 | SQL Injection vulnerability in LOGINT LoMag Inventory Management v1.0.20.120 and before allows an attacker to execute arbitrary code via the ArticleGetGroups… |
CVE-2024-33332 | High | 7.5 | 2024-04-30 | An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant. |
CVE-2024-29320 | High | 8.1 | 2024-04-30 | Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. |
CVE-2024-33275 | Critical | 9.8 | 2024-04-30 | SQL injection vulnerability in Webbax supernewsletter v.1.4.21 and before allows a remote attacker to escalate privileges via the Super Newsletter module in th… |
CVE-2024-33273 | Critical | 9.8 | 2024-04-30 | SQL injection vulnerability in shipup before v.3.3.0 allows a remote attacker to escalate privileges via the getShopID function. |
CVE-2024-33267 | Critical | 9.8 | 2024-04-30 | SQL Injection vulnerability in Hero hfheropayment v.1.2.5 and before allows an attacker to escalate privileges via the HfHeropaymentGatewayBackModuleFrontContr… |
CVE-2024-28294 | Medium | 6.5 | 2024-04-29 | Limbas up to v5.2.14 was discovered to contain a SQL injection vulnerability via the ftid parameter. |
CVE-2024-33276 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the PreorderMode… |
CVE-2024-33272 | Medium | 6.8 | 2024-04-29 | SQL injection vulnerability in KnowBand for PrestaShop autosuggest before 2.0.0 allows an attacker to run arbitrary SQL commands via the AutosuggestSearchModul… |
CVE-2024-33269 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Prestaddons flashsales 1.9.7 and before allows an attacker to run arbitrary SQL commands via the FsModel::getFlashSales method. |
CVE-2024-33268 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Digincube mdgiftproduct before 1.4.1 allows an attacker to run arbitrary SQL commands via the MdGiftRule::addGiftToCart method. |
CVE-2024-33266 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Helloshop deliveryorderautoupdate v.2.8.1 and before allows an attacker to run arbitrary SQL commands via the Deliveryorderautou… |
CVE-2024-31821 | High | 8.0 | 2024-04-29 | SQL Injection vulnerability in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary… |
CVE-2024-31820 | Critical | 9.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the getLa… |
CVE-2024-33444 | Critical | 9.8 | 2024-04-29 | SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component. |
CVE-2024-32493 | High | 8.8 | 2024-04-29 | An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the draft form ID para… |
CVE-2024-4309 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-4308 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-4307 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-33546 | Critical | 9.6 | 2024-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZo… |
CVE-2024-33544 | Critical | 9.3 | 2024-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZo… |
CVE-2024-33559 | Critical | 9.3 | 2024-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XSt… |
CVE-2024-33551 | Critical | 9.3 | 2024-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affect… |
CVE-2024-4257 | Medium | 6.3 | 2024-04-27 | A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /x… |
CVE-2024-3342 | Critical | 9.9 | 2024-04-27 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in… |
CVE-2024-28322 | Critical | 9.8 | 2024-04-26 | SQL Injection vulnerability in /event-management-master/backend/register.php in PuneethReddyHC Event Management 1.0 allows attackers to run arbitrary SQL comma… |
CVE-2024-3060 | Medium | 4.5 | 2024-04-26 | The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL i… |
CVE-2024-3265 | Medium | 4.7 | 2024-04-25 | The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administ… |
CVE-2024-33247 | High | 8.8 | 2024-04-25 | Sourcecodester Employee Task Management System v1.0 is vulnerable to SQL Injection via admin-manage-user.php. |
CVE-2024-32872 | Medium | 5.5 | 2024-04-24 | Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can mod… |
CVE-2024-32706 | High | 8.5 | 2024-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARFo… |
CVE-2024-32710 | High | 8.5 | 2024-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: fr… |
CVE-2024-32709 | Critical | 9.3 | 2024-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: fr… |
CVE-2024-28613 | Critical | 9.8 | 2024-04-24 | SQL Injection vulnerability in PHP Task Management System v.1.0 allows a remote attacker to escalate privileges and obtain sensitive information via the task_i… |
CVE-2024-4093 | Medium | 6.3 | 2024-04-24 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file vie… |
CVE-2024-4071 | Medium | 6.3 | 2024-04-23 | A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-4070 | Medium | 6.3 | 2024-04-23 | A vulnerability has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This vulnerability affects unknown code… |