Export limit exceeded: 46868 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46868 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-31613 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31612 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31611 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31610 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31609 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-30189 | 1 Posthemes | 1 Posstaticblocks | 2025-01-23 | 9.8 Critical |
| Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook(). | ||||
| CVE-2023-29927 | 1 Sage | 1 Sage 300 | 2025-01-23 | 4.3 Medium |
| Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the program’s role-based access controls. | ||||
| CVE-2024-48509 | 2 Lang-learn-guy, Learning With Texts | 2 Learning With Texts, Learning With Texts | 2025-01-23 | 9.8 Critical |
| Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain unauthorized access to the database, retrieve sensitive information, modify or delete data, and execute arbitrary commands. | ||||
| CVE-2023-37869 | 1 Leap13 | 1 Premium Addons | 2025-01-23 | 6.5 Medium |
| Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0. | ||||
| CVE-2024-52518 | 1 Nextcloud | 1 Nextcloud Server | 2025-01-23 | 4.4 Medium |
| Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. | ||||
| CVE-2023-28249 | 1 Microsoft | 12 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 9 more | 2025-01-23 | 6.2 Medium |
| Windows Boot Manager Security Feature Bypass Vulnerability | ||||
| CVE-2023-28270 | 1 Microsoft | 8 Windows 10 1809, Windows 10 20h2, Windows 10 21h2 and 5 more | 2025-01-23 | 6.8 Medium |
| Windows Lock Screen Security Feature Bypass Vulnerability | ||||
| CVE-2024-43282 | 1 Themeum | 1 Tutor Lms | 2025-01-22 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2. | ||||
| CVE-2023-32308 | 1 Anuko | 1 Time Tracker | 2025-01-22 | 8.2 High |
| anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php. | ||||
| CVE-2023-27233 | 1 Piwigo | 1 Piwigo | 2025-01-22 | 8.8 High |
| Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php. | ||||
| CVE-2024-37094 | 1 Stylemixthemes | 1 Masterstudy Lms | 2025-01-22 | 8.2 High |
| Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12. | ||||
| CVE-2023-47822 | 1 Sonaar | 1 Mp3 Audio Player For Music\, Radio \& Podcast | 2025-01-22 | 5.4 Medium |
| Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10. | ||||
| CVE-2023-31702 | 1 Escanav | 1 Escan Management Console | 2025-01-22 | 7.2 High |
| SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1. | ||||
| CVE-2023-30191 | 1 Cdesigner Project | 1 Cdesigner | 2025-01-22 | 9.8 Critical |
| PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent(). | ||||
| CVE-2023-2756 | 1 Pimcore | 1 Customer Management Framework | 2025-01-22 | 7.2 High |
| SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10. | ||||