Total
13955 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-42844 | 2025-03-06 | 8.1 High | ||
| A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. This vulnerability allows authenticated remote attackers to execute arbitrary SQL commands through unsanitized user input fields to obtain unauthorized information | ||||
| CVE-2024-7150 | 1 10web | 1 Slider | 2025-03-06 | 8.8 High |
| The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2021-36392 | 1 Moodle | 1 Moodle | 2025-03-06 | 9.8 Critical |
| In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. | ||||
| CVE-2021-36393 | 1 Moodle | 1 Moodle | 2025-03-06 | 9.8 Critical |
| In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. | ||||
| CVE-2023-5269 | 1 Mayurik | 1 Best Courier Management System | 2025-03-06 | 5.5 Medium |
| A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file parcel_list.php of the component GET Parameter Handler. The manipulation of the argument id/s leads to sql injection. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-12144 | 2025-03-06 | 9.8 Critical | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Finder Fire Safety Finder ERP/CRM (Old System) allows SQL Injection.This issue affects Finder ERP/CRM (Old System): before 18.12.2024. | ||||
| CVE-2024-51962 | 1 Esri | 1 Arcgis Server | 2025-03-06 | 8.7 High |
| A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify Column properties allowing for the execution of a SQL Injection by a remote authenticated user with elevated (non admin) privileges. There is a high impact to integrity and confidentiality and no impact to availability. | ||||
| CVE-2025-1900 | 1 Phpgurukul | 1 Restaurant Table Booking System | 2025-03-06 | 7.3 High |
| A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /add-table.php. The manipulation of the argument tableno leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-1901 | 1 Phpgurukul | 1 Restaurant Table Booking System | 2025-03-06 | 7.3 High |
| A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/check_availability.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-1902 | 1 Phpgurukul | 1 Student Record System | 2025-03-06 | 7.3 High |
| A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /password-recovery.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-1903 | 1 Codezips | 1 Online Shopping Website | 2025-03-06 | 7.3 High |
| A vulnerability was found in Codezips Online Shopping Website 1.0. It has been rated as critical. This issue affects some unknown processing of the file /cart_add.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2023-24789 | 1 Jeecg | 1 Jeecg | 2025-03-05 | 8.8 High |
| jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component. | ||||
| CVE-2021-3854 | 1 Glox | 1 Useroam Hotspot | 2025-03-05 | 9.8 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Glox Technology Useroam Hotspot allows SQL Injection. This issue affects Useroam Hotspot: before 5.1.0.15. | ||||
| CVE-2021-4328 | 1 Lionfish Cms Project | 1 Lionfish Cms | 2025-03-05 | 6.3 Medium |
| A vulnerability has been found in 狮子鱼CMS and classified as critical. Affected by this vulnerability is the function goods_detail of the file ApiController.class.php. The manipulation of the argument goods_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222223. | ||||
| CVE-2014-125091 | 1 Codepeople | 1 Polls Cp | 2025-03-05 | 4.7 Medium |
| A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222268. | ||||
| CVE-2025-25349 | 1 Phpgurukul | 1 Daily Expense Tracker System | 2025-03-05 | 9.8 Critical |
| PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter. | ||||
| CVE-2023-24782 | 1 Funadmin | 1 Funadmin | 2025-03-05 | 9.8 Critical |
| Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit. | ||||
| CVE-2023-24777 | 1 Funadmin | 1 Funadmin | 2025-03-05 | 9.8 Critical |
| Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list. | ||||
| CVE-2023-24773 | 1 Funadmin | 1 Funadmin | 2025-03-05 | 9.8 Critical |
| Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list. | ||||
| CVE-2023-0765 | 1 Bestwebsoft | 1 Gallery | 2025-03-05 | 8.8 High |
| The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable. | ||||