Total
9311 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-48082 | 1 Easyone | 1 Easyone Crm | 2023-02-08 | N/A | 9.8 CRITICAL |
| Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag. | |||||
| CVE-2021-3958 | 1 Ipack | 1 Scada Automation | 2023-02-08 | 7.5 HIGH | 9.8 CRITICAL |
| Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Software: from unspecified before 1.1.0. | |||||
| CVE-2022-45297 | 1 Eq Project | 1 Eq | 2023-02-07 | N/A | 9.8 CRITICAL |
| EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter. | |||||
| CVE-2023-24241 | 1 Forget Heart Message Box Project | 1 Forget Heart Message Box | 2023-02-07 | N/A | 9.8 CRITICAL |
| Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php. | |||||
| CVE-2023-24956 | 1 Forget Heart Message Box Project | 1 Forget Heart Message Box | 2023-02-07 | N/A | 8.8 HIGH |
| Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php. | |||||
| CVE-2023-24163 | 1 Hutool | 1 Hutool | 2023-02-07 | N/A | 9.8 CRITICAL |
| SQL Inection vulnerability in Dromara hutool v5.8.11 allows attacker to execute arbitrary code via the aviator template engine. | |||||
| CVE-2022-47780 | 1 Bangresto Project | 1 Bangresto | 2023-02-07 | N/A | 9.8 CRITICAL |
| SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter. | |||||
| CVE-2023-0570 | 1 Online Tours \& Travels Management System Project | 1 Online Tours \& Travels Management System | 2023-02-07 | N/A | 9.8 CRITICAL |
| A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\payment_operation.php. The manipulation of the argument booking_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219729 was assigned to this vulnerability. | |||||
| CVE-2023-22900 | 1 Thinkingsoftware | 1 Efence | 2023-02-07 | N/A | 9.8 CRITICAL |
| Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database. | |||||
| CVE-2019-13578 | 1 Givewp | 1 Givewp | 2023-02-06 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php. | |||||
| CVE-2021-40961 | 1 Cmsmadesimple | 1 Cms Made Simple | 2023-02-06 | 6.5 MEDIUM | 8.8 HIGH |
| CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '. | |||||
| CVE-2023-22324 | 1 Contec | 1 Conprosys Hmi System | 2023-02-06 | N/A | 6.5 MEDIUM |
| SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbitrary SQL command. As a result, information stored in the database may be obtained. | |||||
| CVE-2019-13571 | 1 Vsourz | 1 Advanced Cf7 Db | 2023-02-06 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system. | |||||
| CVE-2022-31197 | 3 Debian, Fedoraproject, Postgresql | 3 Debian Linux, Fedora, Postgresql Jdbc Driver | 2023-02-06 | N/A | 8.0 HIGH |
| PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue. | |||||
| CVE-2023-0530 | 1 Online Tours \& Travels Management System Project | 1 Online Tours \& Travels Management System | 2023-02-06 | N/A | 9.8 CRITICAL |
| A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/approve_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219599. | |||||
| CVE-2023-0533 | 1 Online Tours \& Travels Management System Project | 1 Online Tours \& Travels Management System | 2023-02-03 | N/A | 4.7 MEDIUM |
| A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is some unknown functionality of the file admin/expense_report.php. The manipulation of the argument from_date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-219602 is the identifier assigned to this vulnerability. | |||||
| CVE-2023-0534 | 1 Online Tours \& Travels Management System Project | 1 Online Tours \& Travels Management System | 2023-02-03 | N/A | 4.7 MEDIUM |
| A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219603. | |||||
| CVE-2023-0531 | 1 Online Tours \& Travels Management System Project | 1 Online Tours \& Travels Management System | 2023-02-03 | N/A | 4.7 MEDIUM |
| A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/booking_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219600. | |||||
| CVE-2023-0562 | 1 Bank Locker Management System Project | 1 Bank Locker Management System | 2023-02-03 | N/A | 9.8 CRITICAL |
| A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716. | |||||
| CVE-2022-44298 | 1 Sscms | 1 Siteserver Cms | 2023-02-03 | N/A | 9.8 CRITICAL |
| SiteServer CMS 7.1.3 is vulnerable to SQL Injection. | |||||