Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (18908 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-24844 2 Gin-vue-admin Project, Postgresql 2 Gin-vue-admin, Postgresql 2025-04-22 8.1 High
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.
CVE-2022-2807 1 Algan 1 Prens Student Information System 2025-04-22 9.8 Critical
SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection.This issue affects Prens Student Information System: before 2.1.11.
CVE-2025-28100 1 Geeeeeeeek 1 Dingfanzu 2025-04-22 9.8 Critical
A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.php" id parameter.
CVE-2022-31092 1 Pimcore 1 Pimcore 2025-04-22 7.5 High
Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting is not done properly in both cases, so there's the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the listing classes. This issue has been resolved in version 10.4.4. Users are advised to upgrade or to apple the patch manually. There are no known workarounds for this issue.
CVE-2022-31101 1 Prestashop 1 Blockwishlist 2025-04-22 8.1 High
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
CVE-2025-29189 1 Flowiseai 1 Flowise 2025-04-22 7.6 High
Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.
CVE-2025-29390 1 Jerryhanjj 1 Erp 2025-04-22 8.8 High
jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php.
CVE-2025-29391 1 Horvey 1 Library-manager 2025-04-22 7.2 High
horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php.
CVE-2024-40068 1 Oretnom23 1 Online Id Generator System 2025-04-22 5.9 Medium
Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=templates/manage_template&id=1.
CVE-2024-40072 1 Oretnom23 1 Online Id Generator System 2025-04-22 9.8 Critical
Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=generate/index&id=1.
CVE-2024-40073 1 Oretnom23 1 Online Id Generator System 2025-04-22 9.8 Critical
Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at id_generator/admin/?page=generate&template=4.
CVE-2024-34226 1 Oretnom23 1 Visitor Management System 2025-04-22 9.4 Critical
SQL injection vulnerability in /php-sqlite-vms/?page=manage_visitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters.
CVE-2024-25897 1 Churchcrm 1 Churchcrm 2025-04-22 9.8 Critical
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
CVE-2022-38488 1 Logrocket-oauth2-example Project 1 Logrocket-oauth2-example 2025-04-22 9.8 Critical
logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.
CVE-2022-30002 1 Angeljudesuarez 1 Insurance Management System 2025-04-22 7.2 High
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee_id=.
CVE-2022-30000 1 Angeljudesuarez 1 Insurance Management System 2025-04-22 9.8 Critical
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt_no=.
CVE-2022-30001 1 Angeljudesuarez 1 Insurance Management System 2025-04-22 9.8 Critical
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editAgent.php?agent_id=.
CVE-2024-1926 1 Mayurik 1 Free And Open Source Inventory Management System 2025-04-22 6.3 Medium
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /app/ajax/search_sales_report.php. The manipulation of the argument customer leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254861 was assigned to this vulnerability.
CVE-2022-29999 1 Angeljudesuarez 1 Insurance Management System 2025-04-22 9.8 Critical
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editClient.php?client_id=.
CVE-2022-27124 1 Angeljudesuarez 1 Insurance Management System 2025-04-22 9.8 Critical
Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.