Export limit exceeded: 47503 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47503 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-39650 | 1 Themevolty | 1 Theme Volty Cms Blog | 2024-11-21 | 9.8 Critical |
| Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single. | ||||
| CVE-2023-39649 | 1 Themevolty | 1 Theme Volty Cms Category Slider | 2024-11-21 | 9.8 Critical |
| Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop. In the module “Theme Volty CMS Category Slider” (tvcmscategoryslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | ||||
| CVE-2023-39648 | 1 Themevolty | 1 Theme Volty Cms Testimonial | 2024-11-21 | 9.8 Critical |
| Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module “Theme Volty CMS Testimonial” (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | ||||
| CVE-2023-39647 | 1 Themevolty | 1 Theme Volty Cms Category Product | 2024-11-21 | 9.8 Critical |
| Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscategoryproduct) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | ||||
| CVE-2023-39646 | 1 Themevolty | 1 Theme Volty Cms Category Chain Slider | 2024-11-21 | 9.8 Critical |
| Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"(tvcmscategorychainslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | ||||
| CVE-2023-39645 | 1 Themevolty | 1 Cms Payment Icon | 2024-11-21 | 9.8 Critical |
| Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” (tvcmspaymenticon) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | ||||
| CVE-2023-39642 | 1 Carts.guru | 1 Cartsguru | 2024-11-21 | 9.8 Critical |
| Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display(). | ||||
| CVE-2023-39641 | 1 Activedesign | 1 Full Affiliates | 2024-11-21 | 9.8 Critical |
| Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent(). | ||||
| CVE-2023-39640 | 1 Uplight | 1 Cookie Law | 2024-11-21 | 9.8 Critical |
| UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList(). | ||||
| CVE-2023-39639 | 1 Leotheme | 1 Leoblog | 2024-11-21 | 9.8 Critical |
| LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs. | ||||
| CVE-2023-39582 | 1 Chamilo | 1 Chamilo Lms | 2024-11-21 | 4.9 Medium |
| SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions. | ||||
| CVE-2023-39560 | 1 Ectouch | 1 Ectouch | 2024-11-21 | 9.8 Critical |
| ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php. | ||||
| CVE-2023-39551 | 1 Phpgurukul | 1 Online Security Guards Hiring System | 2024-11-21 | 9.8 Critical |
| PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php. | ||||
| CVE-2023-39546 | 1 Nec | 2 Expresscluster X, Expresscluster X Singleserversafe | 2024-11-21 | 8.8 High |
| CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command. | ||||
| CVE-2023-39544 | 1 Nec | 2 Expresscluster X, Expresscluster X Singleserversafe | 2024-11-21 | 8.8 High |
| CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command. | ||||
| CVE-2023-39526 | 1 Prestashop | 1 Prestashop | 2024-11-21 | 9.1 Critical |
| PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds. | ||||
| CVE-2023-39524 | 1 Prestashop | 1 Prestashop | 2024-11-21 | 6.7 Medium |
| PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds. | ||||
| CVE-2023-39507 | 1 Recruit | 1 Rikunabi Next | 2024-11-21 | 6.1 Medium |
| Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to lead the vulnerable App to access an arbitrary website. | ||||
| CVE-2023-39438 | 1 Sap | 1 Contributor License Agreement Assistant | 2024-11-21 | 8.1 High |
| A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as well as custom fields the CLA requester had configured. In addition, an arbitrary authenticated user can update or delete the CLA-configuration for repositories or organizations using CLA-assistant. The stored access tokens for GitHub are not affected, as these are redacted from the API-responses. | ||||
| CVE-2023-39423 | 1 Resortdata | 1 Internet Reservation Module Next Generation | 2024-11-21 | 8.6 High |
| The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user. | ||||