Export limit exceeded: 346836 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 18810 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18810 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-52969 | 1 Fortinet | 1 Fortisiem | 2025-02-03 | 3.7 Low |
| An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below Update/Create Case feature may allow an authenticated attacker to extract database information via crafted requests. | ||||
| CVE-2012-5872 | 1 Arc2 Project | 1 Arc2 | 2025-02-03 | 9.8 Critical |
| ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause. | ||||
| CVE-2023-27843 | 1 Ask For A Quote Project | 1 Ask For A Quote | 2025-02-03 | 9.8 Critical |
| SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component. | ||||
| CVE-2023-30545 | 1 Prestashop | 1 Prestashop | 2025-02-03 | 7.7 High |
| PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9 | ||||
| CVE-2023-30211 | 1 Ourphp | 1 Ourphp | 2025-02-03 | 9.8 Critical |
| OURPHP <= 7.2.0 is vulnerable to SQL Injection. | ||||
| CVE-2023-30112 | 1 Medicine Tracker System Project | 1 Medicine Tracker System | 2025-02-03 | 7.5 High |
| Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection. | ||||
| CVE-2023-30839 | 1 Prestashop | 1 Prestashop | 2025-02-03 | 10 Critical |
| PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds. | ||||
| CVE-2023-2338 | 1 Pimcore | 1 Pimcore | 2025-02-03 | 8.8 High |
| SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21. | ||||
| CVE-2019-19245 | 1 Napc | 1 Xinet Elegant 6 Asset Library | 2025-02-02 | 9.8 Critical |
| NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used. | ||||
| CVE-2022-4118 | 1 Coinmarketstats | 1 Bitcoin \/ Altcoin Payment Gateway For Woocommerce | 2025-01-31 | 9.8 Critical |
| The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users | ||||
| CVE-2024-57775 | 1 Jfinaloa Project | 1 Jfinaloa | 2025-01-31 | 8.8 High |
| JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid. | ||||
| CVE-2021-4134 | 1 Radykal | 1 Fancy Product Designer | 2025-01-31 | 7.2 High |
| The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4. | ||||
| CVE-2022-0651 | 1 Veronalabs | 1 Wp Statistics | 2025-01-31 | 9.8 Critical |
| The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5. | ||||
| CVE-2022-25149 | 1 Veronalabs | 1 Wp Statistics | 2025-01-31 | 9.8 Critical |
| The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5. | ||||
| CVE-2023-30849 | 1 Pimcore | 1 Pimcore | 2025-01-31 | 8.8 High |
| Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually. | ||||
| CVE-2023-26781 | 1 Chshcms | 1 Mccms | 2025-01-31 | 9.8 Critical |
| SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search. | ||||
| CVE-2024-35278 | 1 Fortinet | 1 Fortiportal | 2025-01-31 | 4.1 Medium |
| A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request. | ||||
| CVE-2025-24793 | 2025-01-31 | 7 High | ||
| The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1. | ||||
| CVE-2024-35275 | 1 Fortinet | 4 Fortianalyzer, Fortianalyzer Cloud, Fortimanager and 1 more | 2025-01-31 | 6.5 Medium |
| A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests. | ||||
| CVE-2023-33361 | 1 Piwigo | 1 Piwigo | 2025-01-31 | 9.8 Critical |
| Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. | ||||