Export limit exceeded: 235608 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (9518 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-32738 | 1 Cyberpower | 1 Powerpanel | 2025-10-23 | 7.5 High |
| A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_lean" function within MCUDBHelper. | ||||
| CVE-2025-61540 | 3 Myupb, Ultimate Php Board, Ultimate Php Board Project | 3 Ultimate Php Board, Ultimate Php Board, Ultimate Php Board | 2025-10-23 | 6.5 Medium |
| SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php. | ||||
| CVE-2025-6791 | 1 Centreon | 2 Centreon, Centreon Web | 2025-10-22 | 8.8 High |
| In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.This issue affects web: 24.10.0, 24.04.0, 23.10.0. | ||||
| CVE-2025-4650 | 1 Centreon | 2 Centreon, Centreon Web | 2025-10-22 | 7.2 High |
| User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in an SQL Command.This issue affects web: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26. | ||||
| CVE-2025-40657 | 1 Acc | 1 Dm Corporative Cms | 2025-10-22 | 9.8 Critical |
| A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the codform parameter in /modules/forms/collectform.asp. | ||||
| CVE-2025-60307 | 2 Carmelo, Code-projects | 2 Computer Laboratory System, Computer Laboratory System | 2025-10-21 | 9.8 Critical |
| code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can bypass login attempts. | ||||
| CVE-2025-60269 | 2 Huayi-tec, Jeewms | 2 Jeewms, Jeewms | 2025-10-20 | 9.4 Critical |
| JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file. | ||||
| CVE-2021-24755 | 1 Wpexperts | 1 Mycred | 2025-10-17 | 8.8 High |
| The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user | ||||
| CVE-2025-6724 | 2 Chef, Linux | 4 Automate, Chef, Linux and 1 more | 2025-10-16 | 8.8 High |
| In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command. | ||||
| CVE-2025-8868 | 2 Chef, Linux | 4 Automate, Chef, Linux and 1 more | 2025-10-16 | 9.8 Critical |
| In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token. | ||||
| CVE-2025-60265 | 2 Bestfeng, Xckk | 2 Xckk, Xckk | 2025-10-16 | 6.5 Medium |
| In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in user/list is not securely filtered, resulting in a SQL injection vulnerability. | ||||
| CVE-2025-60311 | 1 Projectworlds | 2 Gym Management System, Gym Management System Project | 2025-10-16 | 8.8 High |
| ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page | ||||
| CVE-2025-60266 | 2 Bestfeng, Xckk | 2 Xckk, Xckk | 2025-10-16 | 6.5 Medium |
| In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in address/list is not securely filtered, resulting in a SQL injection vulnerability. | ||||
| CVE-2025-60267 | 2 Bestfeng, Xckk | 2 Xckk, Xckk | 2025-10-16 | 6.5 Medium |
| In xckk v9.6, there is a SQL injection vulnerability in which the cond parameter in notice/list is not securely filtered, resulting in a SQL injection vulnerability. | ||||
| CVE-2025-60316 | 2 Mayurik, Sourcecodester | 2 Pet Grooming Management Software, Pet Grooming Management Software | 2025-10-16 | 9.4 Critical |
| SourceCodester Pet Grooming Management Software 1.0 is vulnerable to SQL Injection in admin/view_customer.php via the ID parameter. | ||||
| CVE-2025-10098 | 1 Phpgurukul | 1 User Management System | 2025-10-15 | 6.3 Medium |
| A security flaw has been discovered in PHPGurukul User Management System 1.0. Affected is an unknown function of the file /admin/edit-user-profile.php. The manipulation of the argument uid results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. | ||||
| CVE-2025-55885 | 1 Ard | 2 Ard, Gec En Ligne | 2025-10-14 | 6.3 Medium |
| SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php | ||||
| CVE-2014-2376 | 1 Ecava | 1 Integraxor | 2025-10-13 | N/A |
| SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | ||||
| CVE-2025-3553 | 1 Phpshe | 1 Phpshe | 2025-10-10 | 6.3 Medium |
| A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /admin.php?mod=brand&act=del. The manipulation of the argument brand_id[] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-3559 | 1 Ghostxbh | 1 Uzy-ssm-mall | 2025-10-10 | 6.3 Medium |
| A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||