Total
9311 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2015-9316 | 1 Wpfastestcache | 1 Wp Fastest Cache | 2019-08-19 | 7.5 HIGH | 9.8 CRITICAL |
| The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter. | |||||
| CVE-2017-18515 | 1 Veronalabs | 1 Wp Statistics | 2019-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| The wp-statistics plugin before 12.0.8 for WordPress has SQL injection. | |||||
| CVE-2017-18548 | 1 Datainterlock | 1 Note Press | 2019-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| The note-press plugin before 0.1.2 for WordPress has SQL injection. | |||||
| CVE-2016-10889 | 1 Imagely | 1 Nextgen Gallery | 2019-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name. | |||||
| CVE-2015-9313 | 1 Newstatpress Project | 1 Newstatpress | 2019-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element. | |||||
| CVE-2015-9315 | 1 Newstatpress Project | 1 Newstatpress | 2019-08-16 | 7.5 HIGH | 9.8 CRITICAL |
| The newstatpress plugin before 1.0.1 for WordPress has SQL injection. | |||||
| CVE-2019-14966 | 1 Frappe | 1 Frappe | 2019-08-16 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection. | |||||
| CVE-2019-13462 | 1 Lansweeper | 1 Lansweeper | 2019-08-15 | 6.4 MEDIUM | 9.1 CRITICAL |
| Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. | |||||
| CVE-2019-14968 | 1 Txjia | 1 Imcat | 2019-08-15 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action. | |||||
| CVE-2019-14754 | 1 Open-school | 1 Open-school | 2019-08-14 | 7.5 HIGH | 9.8 CRITICAL |
| Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter. | |||||
| CVE-2019-14801 | 1 Foliovision | 1 Fv Flowplayer Video Player | 2019-08-14 | 7.5 HIGH | 9.8 CRITICAL |
| The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. | |||||
| CVE-2019-14702 | 1 Microdigital | 6 Mdc-n2190v, Mdc-n2190v Firmware, Mdc-n4090 and 3 more | 2019-08-13 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms that are reachable through HTTPD. An attacker can, for example, create an admin account. | |||||
| CVE-2019-1010259 | 1 Saltstack | 2 Salt 2018, Salt 2019 | 2019-08-13 | 7.5 HIGH | 9.8 CRITICAL |
| SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4. | |||||
| CVE-2016-10839 | 1 Cpanel | 1 Cpanel | 2019-08-13 | 5.5 MEDIUM | 8.1 HIGH |
| cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71). | |||||
| CVE-2017-18406 | 1 Cpanel | 1 Cpanel | 2019-08-12 | 5.0 MEDIUM | 7.5 HIGH |
| cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276). | |||||
| CVE-2019-12279 | 1 Nagios | 1 Nagios Xi | 2019-08-09 | 7.5 HIGH | 9.8 CRITICAL |
| ** DISPUTED ** Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck. | |||||
| CVE-2019-14348 | 1 Beardev | 1 Joomsport | 2019-08-09 | 7.5 HIGH | 9.8 CRITICAL |
| The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter. | |||||
| CVE-2014-3483 | 1 Rubyonrails | 1 Rails | 2019-08-08 | 7.5 HIGH | N/A |
| SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting. | |||||
| CVE-2011-2930 | 1 Rubyonrails | 2 Rails, Ruby On Rails | 2019-08-08 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name. | |||||
| CVE-2012-2695 | 1 Rubyonrails | 2 Rails, Ruby On Rails | 2019-08-08 | 7.5 HIGH | N/A |
| The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661. | |||||