Export limit exceeded: 20483 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20483 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76635 | 1 Baserproject | 1 Basercms | 2026-08-25 | 7.2 High |
| baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend. | ||||
| CVE-2026-76574 | 1 Code-projects | 1 Hospital Information System | 2026-08-25 | 7.3 High |
| A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. | ||||
| CVE-2026-78864 | 1 Liketrek | 1 Trek | 2026-08-25 | 6.3 Medium |
| A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component. | ||||
| CVE-2026-78656 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-08-25 | 6.3 Medium |
| A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-77994 | 1 Joomlack | 1 Page Builder Ck Extension For Joomla | 2026-08-25 | N/A |
| Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model. | ||||
| CVE-2026-75986 | 1 Code-projects | 1 Online Job Portal System | 2026-08-25 | 7.3 High |
| A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-8111 | 1 Ivanti | 1 Endpoint Manager | 2026-08-24 | 8.8 High |
| SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. | ||||
| CVE-2025-46252 | 1 Kofimokome | 1 Message Filter For Contact Form 7 | 2026-08-24 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2. | ||||
| CVE-2026-51366 | 2026-08-24 | 9.9 Critical | ||
| SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter | ||||
| CVE-2026-70818 | 1 Oracle | 1 Hyperion Financial Management | 2026-08-24 | 8.8 High |
| Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-73345 | 2 Saad Iqbal, Wordpress | 2 License Manager For Woocommerce, Wordpress | 2026-08-24 | 7.1 High |
| Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions. | ||||
| CVE-2026-73365 | 2 Crocoblock. Jetimpex Inc., Wordpress | 2 Jetappointment, Wordpress | 2026-08-24 | 9.3 Critical |
| Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. | ||||
| CVE-2026-78200 | 1 Itsourcecode | 1 Library Management System | 2026-08-24 | 6.3 Medium |
| A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. | ||||
| CVE-2026-32471 | 2 Themebing, Wordpress | 2 Prolancer Element, Wordpress | 2026-08-24 | 8.5 High |
| Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions. | ||||
| CVE-2026-32551 | 2 Divinext, Wordpress | 2 Woo Essential, Wordpress | 2026-08-24 | 9.3 Critical |
| Unauthenticated SQL Injection in Woo Essential <= 4.3.0 versions. | ||||
| CVE-2026-78270 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluentcrm | 2026-08-24 | 7.6 High |
| Author SQL Injection in FluentCRM Pro <= 3.1.12 versions. | ||||
| CVE-2026-32478 | 2 Wedevs, Wordpress | 2 Wp Project Manager, Wordpress | 2026-08-24 | 8.5 High |
| Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions. | ||||
| CVE-2026-78112 | 1 Itsourcecode | 1 Hospital Management System Project In Php | 2026-08-24 | 6.3 Medium |
| A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This manipulation of the argument delid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. | ||||
| CVE-2026-76571 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL through the filter condition, giving full read of the database. | ||||
| CVE-2026-78248 | 1 Sourcecodester | 1 Simple Online Food Ordering System | 2026-08-24 | 7.3 High |
| A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. | ||||