Export limit exceeded: 47581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47581 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-2478 | 1 Bradwenqiang | 1 Hr | 2025-01-23 | 6.3 Medium |
| A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256886 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-31608 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31607 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the __libc_malloc component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-30245 | 1 Judging Management System Project | 1 Judging Management System | 2025-01-23 | 9.8 Critical |
| SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id parameter of the edit_criteria.php file. | ||||
| CVE-2024-26004 | 1 Phoenixcontact | 8 Charx Sec-3000, Charx Sec-3000 Firmware, Charx Sec-3050 and 5 more | 2025-01-23 | 7.5 High |
| An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality. | ||||
| CVE-2023-31519 | 1 Pharmacy Management System Project | 1 Pharmacy Management System | 2025-01-23 | 9.8 Critical |
| Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login_core.php. | ||||
| CVE-2023-27742 | 1 Idurarapp | 1 Idurar | 2025-01-23 | 9.8 Critical |
| IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login. | ||||
| CVE-2024-26264 | 1 Ebmtech | 1 Risweb | 2025-01-23 | 9.8 Critical |
| EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records. | ||||
| CVE-2024-57770 | 1 Jfinaloa Project | 1 Jfinaloa | 2025-01-23 | 8.8 High |
| JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. | ||||
| CVE-2024-57769 | 1 Jfinaloa Project | 1 Jfinaloa | 2025-01-23 | 8.8 High |
| JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. | ||||
| CVE-2023-31613 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31612 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31611 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31610 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-31609 | 1 Openlinksw | 1 Virtuoso | 2025-01-23 | 7.5 High |
| An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. | ||||
| CVE-2023-30189 | 1 Posthemes | 1 Posstaticblocks | 2025-01-23 | 9.8 Critical |
| Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook(). | ||||
| CVE-2023-29927 | 1 Sage | 1 Sage 300 | 2025-01-23 | 4.3 Medium |
| Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the program’s role-based access controls. | ||||
| CVE-2024-48509 | 2 Lang-learn-guy, Learning With Texts | 2 Learning With Texts, Learning With Texts | 2025-01-23 | 9.8 Critical |
| Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain unauthorized access to the database, retrieve sensitive information, modify or delete data, and execute arbitrary commands. | ||||
| CVE-2023-37869 | 1 Leap13 | 1 Premium Addons | 2025-01-23 | 6.5 Medium |
| Missing Authorization vulnerability in Premium Addons Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0. | ||||
| CVE-2024-52518 | 1 Nextcloud | 1 Nextcloud Server | 2025-01-23 | 4.4 Medium |
| Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. | ||||