Export limit exceeded: 424644 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47272 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-37858 | 2 Lost And Found Information System Project, Oretnom23 | 2 Lost And Found Information System, Lost And Found Information System | 2025-04-23 | 9.8 Critical |
| SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php. | ||||
| CVE-2024-37857 | 2 Oretnom23, Sourcecodester | 2 Lost And Found Information System, Lost And Found Information System | 2025-04-23 | 8.8 High |
| SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via id parameter to php-lfis/admin/categories/view_category.php. | ||||
| CVE-2024-40402 | 2 Nikhil-bhalerao, Sourcecodester | 2 Simple Library Management System, Simple Library Management System | 2025-04-23 | 6.3 Medium |
| A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries. | ||||
| CVE-2022-44393 | 1 Sanitization Management System Project | 1 Sanitization Management System | 2025-04-23 | 7.2 High |
| Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=. | ||||
| CVE-2024-46078 | 2 Adonesevangelista, Sports Management System Project | 2 Sports Management System, Sports Management System | 2025-04-23 | 7.5 High |
| itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduling/player.php via the argument id. | ||||
| CVE-2024-48356 | 1 Lylme | 1 Lylme Spage | 2025-04-22 | 9.8 Critical |
| LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php. | ||||
| CVE-2024-48573 | 2 Aquila, Aquila-cms | 2 Cms, Aquilacms | 2025-04-22 | 9.8 Critical |
| A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. | ||||
| CVE-2022-45956 | 1 Boa | 1 Boa | 2025-04-22 | 5.3 Medium |
| Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic Authorization mechanism. | ||||
| CVE-2022-45760 | 1 Sens Project | 1 Sens | 2025-04-22 | 8.8 High |
| SENS v1.0 is vulnerable to Incorrect Access Control vulnerability. | ||||
| CVE-2022-3946 | 1 Welcart | 1 Welcart E-commerce | 2025-04-22 | 6.5 Medium |
| The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods. | ||||
| CVE-2022-3881 | 1 Wptools Project | 1 Wptools | 2025-04-22 | 5.7 Medium |
| The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org | ||||
| CVE-2022-3880 | 1 Antihacker Project | 1 Antihacker | 2025-04-22 | 6.5 Medium |
| The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org | ||||
| CVE-2022-3879 | 1 Car Dealer Project | 1 Car Dealer | 2025-04-22 | 6.5 Medium |
| The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org | ||||
| CVE-2022-20240 | 1 Google | 1 Android | 2025-04-22 | 2.3 Low |
| In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-231496105 | ||||
| CVE-2024-20032 | 2 Google, Mediatek | 36 Android, Mt6580, Mt6739 and 33 more | 2025-04-22 | 6.7 Medium |
| In aee, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08487630; Issue ID: MSV-1020. | ||||
| CVE-2025-0532 | 1 Codezips | 1 Gym Management System | 2025-04-22 | 6.3 Medium |
| A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/new_submit.php. The manipulation of the argument m_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2022-43581 | 1 Ibm | 1 Content Navigator | 2025-04-22 | 7.5 High |
| IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization and could allow an authenticated user to load external plugins and execute code. IBM X-Force ID: 238805. | ||||
| CVE-2025-0535 | 1 Codezips | 1 Gym Management System | 2025-04-22 | 6.3 Medium |
| A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem_submit.php. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-0565 | 1 Zzcms | 1 Zzcms | 2025-04-22 | 7.3 High |
| A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-50766 | 2 Oretnom23, Sourcecodester | 2 Survey Application System, Survey Application System | 2025-04-22 | 9.8 Critical |
| SourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter. | ||||