Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (38059 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-0489 1 Native-php-cms Project 1 Native-php-cms 2025-05-05 6.3 Medium
A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0. This vulnerability affects unknown code of the file /fladmin/friendlink_dodel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-0488 1 Native-php-cms Project 1 Native-php-cms 2025-05-05 6.3 Medium
A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file product_list.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-10638 1 Acowebs 1 Product Labels For Woocommerce \(sale Badges\) 2025-05-05 4.1 Medium
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVE-2024-13095 1 Wptriggers 1 Wp Triggers Lite 2025-05-05 4.8 Medium
The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVE-2024-0365 1 Radykal 1 Fancy Product Designer 2025-05-05 6.5 Medium
The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.
CVE-2022-43362 1 Slims 1 Senayan Library Management System 2025-05-05 7.2 High
Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
CVE-2022-43127 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-05 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/update_status.php.
CVE-2022-43081 1 Fast Food Ordering System Project 1 Fast Food Ordering System 2025-05-05 7.5 High
Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php.
CVE-2024-25849 2 Presta Tool Kit, Prestatoolkit 2 Make An Offer For Prestashop, Make An Offer\/offer Your Price 2025-05-05 9.8 Critical
In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::checkUserExistingOffer()` and `MakeOffers::addUserOffer()` .
CVE-2024-25848 1 Team-ever 1 Seo 2025-05-05 5.9 Medium
In the module "Ever Ultimate SEO" (everpsseo) <= 8.1.2 from Team Ever for PrestaShop, a guest can perform SQL injection in affected versions.
CVE-2024-25845 2 Cleanpresta, Prestashop 2 Cd Custom Fields 4 Orders, Prestashop 2025-05-05 9.8 Critical
In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions.
CVE-2024-27515 1 Mindstellar 1 Osclass 2025-05-05 7.2 High
Osclass 5.1.2 is vulnerable to SQL Injection.
CVE-2021-38312 1 Redux 1 Gutenberg Template Library \& Redux Framework 2025-05-05 7.1 High
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.
CVE-2022-3320 1 Cloudflare 1 Warp 2025-05-05 6.7 Medium
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restrictions on a Zero Trust enrolled endpoint.
CVE-2021-37823 1 Opencart 1 Opencart 2025-05-05 4.9 Medium
OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.
CVE-2020-22820 1 Mkcms Project 1 Mkcms 2025-05-05 9.8 Critical
MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.
CVE-2020-22819 1 Mkcms Project 1 Mkcms 2025-05-05 9.8 Critical
MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.
CVE-2020-22818 1 Mkcms Project 1 Mkcms 2025-05-05 9.8 Critical
MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.
CVE-2023-23574 1 Nozominetworks 2 Cmc, Guardian 2025-05-05 8.8 High
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated users may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability.
CVE-2023-2567 1 Nozominetworks 2 Cmc, Guardian 2025-05-05 8.8 High
A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality. Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application.