CWE-89 · SQL Injection (page 99)
Page 99 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48188 | Critical | 9.8 | 2023-11-27 | SQL injection vulnerability in PrestaShop opartdevis v.4.5.18 thru v.4.6.12 allows a remote attacker to execute arbitrary code via a crafted script to the getM… |
CVE-2023-46349 | Critical | 9.8 | 2023-11-27 | In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The… |
CVE-2023-49030 | High | 7.5 | 2023-11-27 | SQL Injection vulnerability in32ns KLive v.2019-1-19 and before allows a remote attacker to obtain sensitive information via a crafted script to the web/user.p… |
CVE-2023-6312 | Medium | 4.7 | 2023-11-27 | A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function delete_user of the file de… |
CVE-2023-6311 | Medium | 4.7 | 2023-11-27 | A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects the function delete_ltype of the file del… |
CVE-2023-6310 | Medium | 4.7 | 2023-11-27 | A vulnerability has been found in SourceCodester Loan Management System 1.0 and classified as critical. This vulnerability affects the function delete_borrower… |
CVE-2023-6306 | Medium | 6.3 | 2023-11-27 | A vulnerability classified as critical has been found in SourceCodester Free and Open Source Inventory Management System 1.0. Affected is an unknown function o… |
CVE-2023-6305 | Medium | 6.3 | 2023-11-27 | A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknow… |
CVE-2023-6276 | Medium | 6.3 | 2023-11-24 | A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/ct/delete.php. The… |
CVE-2023-46575 | Critical | 9.8 | 2023-11-24 | A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary c… |
CVE-2023-3631 | Critical | 9.8 | 2023-11-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows S… |
CVE-2023-3377 | Critical | 9.8 | 2023-11-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection… |
CVE-2023-46357 | Critical | 9.8 | 2023-11-22 | In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `motiva… |
CVE-2023-45377 | Critical | 9.8 | 2023-11-22 | In the module "Chronopost Official" (chronopost) for PrestaShop, a guest can perform SQL injection. The script PHP `cancelSkybill.php` own a sensitive SQL call… |
CVE-2023-5466 | High | 8.8 | 2023-11-22 | The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient… |
CVE-2023-5465 | High | 8.8 | 2023-11-22 | The Popup with fancybox plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.5 due to insufficien… |
CVE-2023-2841 | High | 7.2 | 2023-11-22 | The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including… |
CVE-2023-2889 | Critical | 9.8 | 2023-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veon Computer Service Tracking Software allows SQL Inject… |
CVE-2023-5047 | Critical | 9.8 | 2023-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection. This iss… |
CVE-2023-37924 | Critical | 9.8 | 2023-11-22 | Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fi… |
CVE-2023-5652 | Critical | 9.8 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL… |
CVE-2023-5640 | Critical | 9.8 | 2023-11-20 | The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to una… |
CVE-2023-46700 | Critical | 9.8 | 2023-11-20 | SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote una… |
CVE-2023-22275 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2023-22268 | Medium | 6.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2023-45387 | Critical | 9.8 | 2023-11-17 | In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform… |
CVE-2023-48078 | Critical | 9.8 | 2023-11-17 | SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter. |
CVE-2021-35437 | Critical | 9.8 | 2023-11-16 | SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class. |
CVE-2023-47637 | High | 8.8 | 2023-11-15 | Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on f… |
CVE-2023-47445 | Critical | 9.8 | 2023-11-15 | Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page. |
CVE-2023-40923 | High | 8.8 | 2023-11-15 | MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_setting parameters. |
CVE-2023-47308 | Critical | 9.8 | 2023-11-15 | In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL i… |
CVE-2023-43979 | Critical | 9.8 | 2023-11-15 | ETS Soft ybc_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component Ybc_blogBlogModuleFrontController::getPosts(). |
CVE-2023-46582 | High | 7.8 | 2023-11-14 | SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.ph… |
CVE-2023-46581 | Medium | 5.5 | 2023-11-14 | SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the reg… |
CVE-2023-46025 | Medium | 4.9 | 2023-11-14 | SQL Injection vulnerability in teacher-info.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to obtain sensitive information… |
CVE-2023-46024 | High | 7.5 | 2023-11-14 | SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQL commands and obta… |
CVE-2023-46023 | Medium | 6.5 | 2023-11-14 | SQL injection vulnerability in addTask.php in Code-Projects Simple Task List 1.0 allows attackers to obtain sensitive information via the 'status' parameter. |
CVE-2023-46022 | High | 7.8 | 2023-11-14 | SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via the 'bid' parameter. |
CVE-2023-34991 | Critical | 9.8 | 2023-11-14 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4… |
CVE-2023-45684 | High | 7.5 | 2023-11-14 | Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The iss… |
CVE-2023-46097 | Medium | 6.3 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly neutralize user provided i… |
CVE-2023-47609 | High | 8.8 | 2023-11-14 | SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter t… |
CVE-2023-46021 | Medium | 5.5 | 2023-11-13 | SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' parameter. |
CVE-2023-46018 | Medium | 5.5 | 2023-11-13 | SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \allows attackers to run arbitrary SQL commands via 'remail' parameter. |
CVE-2023-46017 | Medium | 5.5 | 2023-11-13 | SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail' and 'rpassword' pa… |
CVE-2023-46014 | Medium | 5.5 | 2023-11-13 | SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'hemail' and 'hpassword' pa… |
CVE-2023-6097 | Critical | 9.4 | 2023-11-13 | A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a… |
CVE-2023-6084 | Medium | 6.3 | 2023-11-12 | A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/veh… |
CVE-2023-47128 | Critical | 9.1 | 2023-11-10 | Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all… |
CVE-2023-41285 | High | 7.4 | 2023-11-10 | A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via… |
CVE-2023-41284 | High | 7.4 | 2023-11-10 | A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via… |
CVE-2023-6074 | Medium | 6.3 | 2023-11-10 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2023-39796 | Critical | 9.8 | 2023-11-10 | SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE… |
CVE-2023-6054 | Medium | 5.5 | 2023-11-09 | A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/manage/lock… |
CVE-2023-6053 | Medium | 6.3 | 2023-11-09 | A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9. Affected by this issue is some unknown functionality of the fil… |
CVE-2023-6052 | Medium | 6.3 | 2023-11-09 | A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. Affected is an unknown function of the file general/system/censor_words/mod… |
CVE-2021-43609 | Critical | 9.9 | 2023-11-09 | An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app… |
CVE-2023-46800 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_profile.php resource do… |
CVE-2023-46793 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register()' function of th… |
CVE-2023-46789 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart param… |
CVE-2023-46788 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter in the 'uploadphoto()' function of… |
CVE-2023-46787 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the auth/auth.php resource… |
CVE-2023-46785 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partner_preference.php resou… |
CVE-2023-46679 | Critical | 9.8 | 2023-11-07 | Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index.php resource does… |
CVE-2023-46677 | Critical | 9.8 | 2023-11-07 | Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname' parameter of the sign-up.php resource does not… |
CVE-2023-33481 | Critical | 9.8 | 2023-11-07 | RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php. |
CVE-2023-33479 | Critical | 9.8 | 2023-11-07 | RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file. |
CVE-2023-33478 | Critical | 9.8 | 2023-11-07 | RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php. |
CVE-2023-5709 | High | 8.8 | 2023-11-07 | The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient… |
CVE-2023-42284 | Critical | 9.8 | 2023-11-07 | Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query. |
CVE-2023-42283 | Critical | 9.8 | 2023-11-07 | Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query. |
CVE-2023-5082 | High | 7.2 | 2023-11-06 | The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-46823 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image Builder for WordPres… |
CVE-2023-46821 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+)… |
CVE-2023-46084 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This… |
CVE-2023-45830 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL I… |
CVE-2023-45657 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects N… |
CVE-2023-45074 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wan… |
CVE-2023-45069 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Video Gallery by Total-Soft Video Gallery – Best WordPres… |
CVE-2023-45055 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InspireUI MStore API allows SQL Injection.This issue affe… |
CVE-2023-45046 | Medium | 5.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.T… |
CVE-2023-45001 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Castos Seriously Simple Stats allows SQL Injection.This i… |
CVE-2023-41685 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System allows SQL Injection.T… |
CVE-2023-40609 | High | 8.2 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allow… |
CVE-2023-40207 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedNao Donations Made Easy – Smart Donations allows SQL I… |
CVE-2023-38382 | Critical | 9.8 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Cat… |
CVE-2023-35911 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Generator : Creative form… |
CVE-2023-33924 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Felix Welberg SIS Handball allows SQL Injection.This issu… |
CVE-2023-28748 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in biztechc Copy or Move Comments allows SQL Injection.This… |
CVE-2023-27605 | Medium | 5.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sajjad Hossain WP Reroute Email allows SQL Injection.This… |
CVE-2022-47432 | Medium | 6.7 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB allows SQL Inje… |
CVE-2022-47430 | Medium | 6.7 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar The School Management – Education & Learning Man… |
CVE-2022-47428 | Medium | 6.7 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System all… |
CVE-2022-47420 | Medium | 6.4 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL I… |
CVE-2022-46860 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaizenCoders Short URL allows SQL Injection.This issue af… |
CVE-2022-46849 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar Coming Soon Page – Responsive Coming Soon & Main… |
CVE-2022-45373 | High | 8.8 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL In… |
CVE-2023-46981 | Critical | 9.8 | 2023-11-05 | SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/… |
CVE-2023-40922 | Critical | 9.8 | 2023-11-04 | kerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart parameter at KerawenDeliveryModuleFrontController::initConten… |