Total
17788 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-32569 | 1 Veritas | 1 Infoscale Operations Manager | 2025-01-28 | N/A | 7.2 HIGH |
| An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web application is vulnerable to SQL Injection in some of the areas of the application. This allows attackers (who must have admin credentials) to submit arbitrary SQL commands on the back-end database to create, read, update, or delete any sensitive data stored in the database. | |||||
| CVE-2017-20196 | 2025-01-28 | 6.0 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in Itechscripts School Management Software 2.75. It has been classified as critical. This affects an unknown part of the file /notice-edit.php. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-29889 | 1 Glpi-project | 1 Glpi | 2025-01-28 | N/A | 7.1 HIGH |
| GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15. | |||||
| CVE-2023-30194 | 1 Prestashop | 1 Poststaticfooter | 2025-01-27 | N/A | 9.8 CRITICAL |
| Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook(). | |||||
| CVE-2023-30192 | 1 Prestashop | 1 Possearchproducts | 2025-01-27 | N/A | 9.8 CRITICAL |
| Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). | |||||
| CVE-2023-29863 | 1 Medisys | 1 Weblab | 2025-01-27 | N/A | 9.8 CRITICAL |
| Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL files. | |||||
| CVE-2023-28359 | 1 Rocket.chat | 1 Rocket.chat | 2025-01-27 | N/A | 5.3 MEDIUM |
| A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact. | |||||
| CVE-2025-24667 | 2025-01-27 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology Small Package Quotes – Worldwide Express Edition allows SQL Injection. This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through 5.2.17. | |||||
| CVE-2025-24665 | 2025-01-27 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology Small Package Quotes – Unishippers Edition allows SQL Injection. This issue affects Small Package Quotes – Unishippers Edition: from n/a through 2.4.8. | |||||
| CVE-2025-24664 | 2025-01-27 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology LTL Freight Quotes – Worldwide Express Edition allows SQL Injection. This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.0.20. | |||||
| CVE-2025-24612 | 2025-01-27 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MORKVA Shipping for Nova Poshta allows SQL Injection. This issue affects Shipping for Nova Poshta: from n/a through 1.19.6. | |||||
| CVE-2024-25937 | 1 Deltaww | 1 Diaenergie | 2025-01-24 | N/A | 8.8 HIGH |
| SQL injection vulnerability exists in the script DIAE_tagHandler.ashx. | |||||
| CVE-2024-13426 | 1 Wp-polls Project | 1 Wp-polls | 2025-01-24 | N/A | 5.4 MEDIUM |
| The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries. Those queries are stored and results are not displayed to the attacker, which means they cannot be exploited to obtain any additional information about the database. However, a properly configured payload allows for the injection of malicious JavaScript resulting in Stored Cross-Site Scripting. | |||||
| CVE-2024-29870 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter./sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | |||||
| CVE-2024-29871 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | |||||
| CVE-2024-29872 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, 'agencyids' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | |||||
| CVE-2024-29873 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | |||||
| CVE-2024-29874 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/activeuserrptpdf, 'sort_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | |||||
| CVE-2024-29875 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | |||||
| CVE-2024-29876 | 1 Sapplica | 1 Sentrifugo | 2025-01-24 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it. | |||||