Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,732

CVE-2024-58308

Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin Login

Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like ' or '1'='1 to gain unauthorized administrative access to the system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Opensolution
Products
Quick.cms Quick.cms.ext Quick Cms
CVE-2024-58307

CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint

CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Cszcms
Products
Csz Cms Cszcms
CVE-2023-53975

Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page

Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Thedigitalcraft
Products
Atomcms
CVE-2023-53972

WebTareas 2.4 Unauthenticated SQL Injection via Session Cookie Parameter

WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Webtareas Project
Products
Webtareas
CVE-2023-53926

PHPJabbers Simple CMS 5.0 SQL Injection via Column Parameter

PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify database information.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Phpjabbers Simple-cms Project
Products
Simple Cms Simple Cms
CVE-2023-53917

Affiliate Me 5.0.1 SQL Injection Vulnerability via Admin Panel

Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated administrators to manipulate database queries. Attackers can exploit the 'id' parameter with crafted union-based queries to extract sensitive user information including usernames and password hashes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Powerstonegh
Products
Affiliate Me
CVE-2023-53877

Bus Reservation System 1.1 Multiple SQL Injection via pickup_id Parameter

Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to steal information from the database.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Phpjabbers
Products
Bus Reservation System
CVE-2022-50895

Aero CMS 0.0.1 - SQL Injection

Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, time-based, and UNION query techniques to extract sensitive database information and potentially compromise the system.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Aerocms Project Megatkc
Products
Aerocms Aero Cms
CVE-2022-50894

VIAVIWEB Wallpaper Admin 1.0 SQL Injection via edit_gallery_image.php

VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the img_id parameter. Attackers can send GET requests to edit_gallery_image.php with malicious img_id values to extract database information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Viaviweb
Products
Wallpaper Admin
CVE-2022-50892

VIAVIWEB Wallpaper Admin 1.0 - SQL Injection via Login Page

VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials. Attackers can exploit the login page by injecting 'admin' or 1=1-- - payload to gain unauthorized access to the administrative interface.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Viaviweb
Products
Wallpaper Admin
CVE-2021-47720

Orangescrum 1.8.0 Authenticated SQL Injection via Multiple Parameters

Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable parameters. Attackers can inject malicious SQL code into parameters like old_project_id, project_id, uuid, and uniqid to potentially extract or modify database information.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Orangescrum
Products
Orangescrum
CVE-2021-47714

Hasura GraphQL 1.3.3 Local File Read via SQL Injection

Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbitrary files on the server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hasura
Products
Graphql Engine
CVE-2021-47704

OpenBMCS SQL Injection via obix_test.php

OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attackers can send GET requests to /debug/obix_test.php with malicious 'id' values to extract database information.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openbmcs
Products
Openbmcs
CVE-2019-25506

FreeSMS 2.1.2 Authentication Bypass via SQL Injection

FreeSMS 2.1.2 contains a boolean-based blind SQL injection vulnerability in the password parameter that allows unauthenticated attackers to bypass authentication by injecting SQL code through the login endpoint. Attackers can exploit the vulnerable password parameter in requests to /pages/crc_handler.php?method=login to authenticate as any known user and subsequently modify their password via the profile update function.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Freesms Freesms Project
Products
Freesms Freesms
CVE-2019-25505

Tradebox 5.4 SQL Injection via symbol Parameter

Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbol parameter. Attackers can send POST requests to the monthly_deposit endpoint with malicious symbol values using boolean-based blind, time-based blind, error-based, or union-based SQL injection techniques to extract sensitive database information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bdtask
Products
Tradebox
CVE-2019-25503

PHPads 2.0 SQL Injection via click.php3 bannerID

PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bannerID parameter in click.php3. Attackers can submit crafted bannerID values using SQL comment syntax and functions like extractvalue to extract sensitive database information such as the current database name.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Blondish
Products
Phpads
CVE-2019-25497

osCommerce 2.3.4.1 SQL Injection via currency Parameter

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-based SQL injection payloads to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Oscommerce
Products
Oscommerce
CVE-2019-25496

osCommerce 2.3.4.1 SQL Injection via products_id Parameter

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter. Attackers can modify the products_id value in product_info.php requests and append boolean-based SQL injection payloads to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Oscommerce
Products
Oscommerce
CVE-2019-25495

osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter

osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter. Attackers can send GET requests to product_reviews_write.php with malicious reviews_id values using boolean-based SQL injection payloads to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Oscommerce
Products
Oscommerce
CVE-2019-25494

Homey BNB V4 SQL Injection Authentication Bypass via Admin Panel

Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Doditsolutions
Products
Airbnb Clone Script Homey Bnb (airbnb Clone Script)