Total
12999 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-47911 | 1 Sonarsource | 1 Sonarqube | 2024-10-07 | 6.7 Medium |
| In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands. | ||||
| CVE-2024-46078 | 1 Sports Management System Project | 1 Sports Management System | 2024-10-07 | 7.5 High |
| itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduling/player.php via the argument id. | ||||
| CVE-2024-41512 | 1 Cadclick | 1 Cadclick | 2024-10-07 | 8.8 High |
| A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitrary SQL commands via the "bomid" parameter. | ||||
| CVE-2023-31940 | 1 Online Travel Agency System Project | 1 Online Travel Agency System | 2024-10-07 | 7.2 High |
| SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the page_id parameter at article_edit.php. | ||||
| CVE-2023-31939 | 1 Online Travel Agency System Project | 1 Online Travel Agency System | 2024-10-07 | 7.2 High |
| SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomer_id parameter at customer_edit.php. | ||||
| CVE-2023-31938 | 1 Online Travel Agency System Project | 1 Online Travel Agency System | 2024-10-07 | 7.2 High |
| SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id parameter at employee_detail.php. | ||||
| CVE-2024-9018 | 2 Hahncgdev, Plugingarden | 2 Wp Easy Gallery Wordpress Gallery Plugin, Wp Easy Gallery | 2024-10-07 | 8.8 High |
| The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2024-45999 | 2 Cloudlog, Magicbug | 2 Cloudlog, Cloudlog | 2024-10-07 | 6.6 Medium |
| A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/Oqrs_model.php. The vulnerability is exploitable via the station_id parameter. | ||||
| CVE-2024-9536 | 1 Esafenet | 1 Cdg | 2024-10-07 | 6.3 Medium |
| A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /MultiServerBackService?path=1. The manipulation of the argument fileId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2024-47350 | 1 Yithemes | 1 Yith Woocommerce Ajax Search | 2024-10-07 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Ajax Search allows SQL Injection.This issue affects YITH WooCommerce Ajax Search: from n/a through 2.8.0. | ||||
| CVE-2024-47338 | 2024-10-07 | 7.6 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExpertsio WPExperts Square For GiveWP allows SQL Injection.This issue affects WPExperts Square For GiveWP: from n/a through 1.3. | ||||
| CVE-2024-47335 | 2024-10-07 | 7.6 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Form Bit Form – Contact Form Plugin allows SQL Injection.This issue affects Bit Form – Contact Form Plugin: from n/a through 2.13.11. | ||||
| CVE-2024-45249 | 1 Cavok | 1 Cavok | 2024-10-07 | 9.8 Critical |
| Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | ||||
| CVE-2024-6928 | 2 Opti.marketing, Optimarketing | 2 Opti Marketing, Opti Marketing | 2024-10-07 | 9.8 Critical |
| The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | ||||
| CVE-2024-8379 | 1 Stylemixthemes | 1 Cost Calculator Builder | 2024-10-07 | 7.2 High |
| The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin. | ||||
| CVE-2023-39807 | 1 Nvki | 1 Intelligent Broadband Subscriber Gateway | 2024-10-07 | 9.8 Critical |
| N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php. | ||||
| CVE-2024-9293 | 2 Skyselang, Yyladmin Project | 2 Yyladmin, Yyladmin | 2024-10-07 | 6.3 Medium |
| A vulnerability classified as critical was found in skyselang yylAdmin up to 3.0. Affected by this vulnerability is the function list of the file /app/admin/controller/file/File.php of the component Backend. The manipulation of the argument is_disable leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-6926 | 1 Wow-company | 2 Viral-signup, Viral Signup | 2024-10-07 | 9.8 Critical |
| The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection | ||||
| CVE-2024-24142 | 1 Rems | 1 School Task Manager | 2024-10-05 | 9.8 Critical |
| Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter. | ||||
| CVE-2023-39344 | 1 Fobybus | 1 Social-media-skeleton | 2024-10-04 | 10 Critical |
| social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, which indirectly leads to remote code execution. Commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1 contains a fix for this issue. | ||||