Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (37331 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-39811 1 Italtel 1 Netmatch-s Ci 2025-03-28 9.1 Critical
Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).
CVE-2022-46499 2 Codeastro, Phpgurukul 2 Hospital Management System, Hospital Management System 2025-03-28 8.8 High
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single_patient.php.
CVE-2022-46498 2 Codeastro, Phpgurukul 2 Hospital Management System, Hospital Management System 2025-03-28 2.7 Low
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php.
CVE-2022-46497 2 Codeastro, Phpgurukul 2 Hospital Management System, Hospital Management System 2025-03-28 8.1 High
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_patien.php.
CVE-2022-48011 1 Opencats 1 Opencats 2025-03-28 9.8 Critical
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
CVE-2025-25514 1 Seacms 1 Seacms 2025-03-28 6.5 Medium
Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.
CVE-2025-25515 1 Seacms 1 Seacms 2025-03-28 8.8 High
Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.
CVE-2025-25516 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.
CVE-2025-25517 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.
CVE-2025-25519 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.
CVE-2025-25520 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.
CVE-2025-25521 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.
CVE-2024-29275 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php.
CVE-2021-36880 1 Stylemixthemes 1 Ulisting 2025-03-28 8.6 High
Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom.
CVE-2021-36909 1 Webfactoryltd 1 Wp Reset Pro 2025-03-28 8.8 High
Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
CVE-2021-36917 1 Wpwave 1 Hide My Wp 2025-03-28 6.5 Medium
WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.
CVE-2021-36916 1 Wpwave 1 Hide My Wp 2025-03-28 8.6 High
The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwp_get_user_ip" tries to retrieve the IP address from multiple headers, including IP address headers that the user can spoof, such as "X-Forwarded-For." As a result, the malicious payload supplied in one of these IP address headers will be directly inserted into the SQL query, making SQL injection possible.
CVE-2024-53438 1 Churchcrm 1 Churchcrm 2025-03-28 9.8 Critical
EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.
CVE-2024-55104 1 Phpgurukul 1 Online Nurse Hiring System 2025-03-28 7.2 High
Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailid parameters.
CVE-2024-55103 1 Phpgurukul 1 Online Nurse Hiring System 2025-03-28 7.2 High
Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter.