Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8871 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-0258 1 Pimcore 1 Pimcore 2024-11-21 8.8 High
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-0224 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 9.8 Critical
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
CVE-2021-4301 1 Phpwcms 1 Phpwcms 2024-11-21 6.3 Medium
A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is identified as 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability.
CVE-2021-45406 1 Salonerp Project 1 Salonerp 2024-11-21 8.8 High
In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password.
CVE-2021-43609 1 Spiceworks 1 Help Desk Server 2024-11-21 9.9 Critical
An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app/models/reporting/database_query.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be leveraged to leak local files from the host system, leading to remote code execution (RCE) through deserialization of malicious data.
CVE-2021-41654 1 Wuzhicms 1 Wuzhicms 2024-11-21 9.8 Critical
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php
CVE-2021-41487 1 Nokia 1 Vitalsuite 2024-11-21 9.8 Critical
NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'.
CVE-2021-41408 1 Voipmonitor 1 Voipmonitor 2024-11-21 9.8 Critical
VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter.
CVE-2021-3604 1 Primion-digitek 1 Secure 8 2024-11-21 9.8 Critical
Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database.
CVE-2021-3286 1 Spotweb Project 1 Spotweb 2024-11-21 9.8 Critical
SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists because of an incomplete fix for CVE-2020-35545.
CVE-2021-3278 1 Local Services Search Engine Management System Project 1 Local Services Search Engine Management System 2024-11-21 9.8 Critical
Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnerability, an attacker can bypass the login page.
CVE-2021-3264 1 Cxuu 1 Cxuucms 2024-11-21 7.2 High
SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php.
CVE-2021-3262 1 Trispark 2 Novusedu, Veo Transportation 2024-11-21 9.8 Critical
TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the "Student Busing Information" search queries.
CVE-2021-3242 1 Duxcms Project 1 Duxcms 2024-11-21 9.8 Critical
DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.
CVE-2021-3239 1 E-learning System Project 1 E-learning System 2024-11-21 9.8 Critical
E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the hosting web server and gain a reverse shell.
CVE-2021-3118 1 Medicalexpo 1 Ecs Imaging 2024-11-21 9.8 Critical
EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form (such as /req_password_user.php?email=). This allows an attacker to steal data in the database and obtain access to the application. (The database component runs as root.) NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-3110 1 Prestashop 1 Prestashop 2024-11-21 9.8 Critical
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.
CVE-2021-3025 1 Invisioncommunity 1 Ips Community Suite 2024-11-21 8.8 High
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php).
CVE-2021-3021 1 Ispconfig 1 Ispconfig 2024-11-21 9.8 Critical
ISPConfig before 3.2.2 allows SQL injection.
CVE-2021-3018 1 Ipeak 1 Ipeakcms 2024-11-21 9.8 Critical
ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page.