Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20045 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-69935 1 Codeastro 1 Membership Management System 2026-08-03 9.8 Critical
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
CVE-2025-69930 1 Codeastro 1 Membership Management System 2026-08-03 9.8 Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.
CVE-2025-69941 1 Sourcecodester 1 Tailor Management System 2026-08-03 9.8 Critical
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.
CVE-2026-65526 2 Themeisle, Wordpress 2 Visualizer, Wordpress 2026-08-03 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.
CVE-2026-51946 2026-08-03 6.5 Medium
SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints
CVE-2026-54404 2026-08-03 8.8 High
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
CVE-2026-50747 2026-08-03 9.9 Critical
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.
CVE-2026-52470 1 Streamax 1 Streamax Crocus 2026-08-03 9.8 Critical
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
CVE-2026-52476 2026-08-03 7.5 High
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file
CVE-2026-60582 1 Oracle 1 Enterprise Command Center Framework 2026-08-02 8.3 High
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Command Center Framework accessible data as well as unauthorized read access to a subset of Oracle Enterprise Command Center Framework accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).
CVE-2025-45868 1 Logicaldoc 1 Logicaldoc 2026-08-02 8.8 High
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries via crafted input.
CVE-2026-15906 2 Codename065, Wordpress 2 Premium Packages – Sell Digital Products Securely, Wordpress 2026-08-02 6.5 Medium
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-65336 1 Creativesaiful 1 Ecommerce-project-with-php-and-mysqli-fruits-bazar 2026-08-02 9.8 Critical
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.
CVE-2025-69947 1 Sourcecodester 1 Tailor Management System 2026-08-02 9.8 Critical
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
CVE-2026-59525 2 Rolandbarkerxnauwebdesign, Wordpress 2 Participants Database, Wordpress 2026-08-02 9.3 Critical
Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.
CVE-2026-61948 2 Shahjada, Wordpress 2 Wpdm Premium Packages, Wordpress 2026-08-02 9.3 Critical
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
CVE-2026-65454 2 Expresstech, Wordpress 2 Quiz And Survey Master, Wordpress 2026-08-02 8.5 High
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
CVE-2026-65494 2 Dokan, Wordpress 2 Dokan, Wordpress 2026-08-02 7.1 High
Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.
CVE-2025-69938 1 Codeastro 1 Membership Management System 2026-08-02 9.8 Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
CVE-2026-63221 1 Codeigniter 1 Codeigniter 2026-08-02 9.4 Critical
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.