Export limit exceeded: 47434 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47434 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-10638 | 1 Acowebs | 1 Product Labels For Woocommerce \(sale Badges\) | 2025-05-05 | 4.1 Medium |
| The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks | ||||
| CVE-2024-13095 | 1 Wptriggers | 1 Wp Triggers Lite | 2025-05-05 | 4.8 Medium |
| The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks | ||||
| CVE-2024-0365 | 1 Radykal | 1 Fancy Product Designer | 2025-05-05 | 6.5 Medium |
| The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators. | ||||
| CVE-2022-43362 | 1 Slims | 1 Senayan Library Management System | 2025-05-05 | 7.2 High |
| Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php. | ||||
| CVE-2022-43127 | 1 Online Diagnostic Lab Management System Project | 1 Online Diagnostic Lab Management System | 2025-05-05 | 7.2 High |
| Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/update_status.php. | ||||
| CVE-2022-43081 | 1 Fast Food Ordering System Project | 1 Fast Food Ordering System | 2025-05-05 | 7.5 High |
| Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php. | ||||
| CVE-2024-25849 | 2 Presta Tool Kit, Prestatoolkit | 2 Make An Offer For Prestashop, Make An Offer\/offer Your Price | 2025-05-05 | 9.8 Critical |
| In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::checkUserExistingOffer()` and `MakeOffers::addUserOffer()` . | ||||
| CVE-2024-25848 | 1 Team-ever | 1 Seo | 2025-05-05 | 5.9 Medium |
| In the module "Ever Ultimate SEO" (everpsseo) <= 8.1.2 from Team Ever for PrestaShop, a guest can perform SQL injection in affected versions. | ||||
| CVE-2024-25845 | 2 Cleanpresta, Prestashop | 2 Cd Custom Fields 4 Orders, Prestashop | 2025-05-05 | 9.8 Critical |
| In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions. | ||||
| CVE-2024-27515 | 1 Mindstellar | 1 Osclass | 2025-05-05 | 7.2 High |
| Osclass 5.1.2 is vulnerable to SQL Injection. | ||||
| CVE-2021-38312 | 1 Redux | 1 Gutenberg Template Library \& Redux Framework | 2025-05-05 | 7.1 High |
| The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts. | ||||
| CVE-2022-3320 | 1 Cloudflare | 1 Warp | 2025-05-05 | 6.7 Medium |
| It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restrictions on a Zero Trust enrolled endpoint. | ||||
| CVE-2021-37823 | 1 Opencart | 1 Opencart | 2025-05-05 | 4.9 Medium |
| OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background. | ||||
| CVE-2020-22820 | 1 Mkcms Project | 1 Mkcms | 2025-05-05 | 9.8 Critical |
| MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter. | ||||
| CVE-2020-22819 | 1 Mkcms Project | 1 Mkcms | 2025-05-05 | 9.8 Critical |
| MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter. | ||||
| CVE-2020-22818 | 1 Mkcms Project | 1 Mkcms | 2025-05-05 | 9.8 Critical |
| MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter. | ||||
| CVE-2023-23574 | 1 Nozominetworks | 2 Cmc, Guardian | 2025-05-05 | 8.8 High |
| A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated users may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability. | ||||
| CVE-2023-2567 | 1 Nozominetworks | 2 Cmc, Guardian | 2025-05-05 | 8.8 High |
| A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality. Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application. | ||||
| CVE-2023-3444 | 1 Gitlab | 1 Gitlab | 2025-05-05 | 5.7 Medium |
| An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches. | ||||
| CVE-2023-1035 | 1 Oretnom23 | 1 Clinic\'s Patient Management System | 2025-05-05 | 6.3 Medium |
| A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as critical. Affected is an unknown function of the file update_user.php. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221784. | ||||