Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (37412 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-37600 1 Sourcecodester 1 Patient Appointment Scheduler System 2026-04-17 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.
CVE-2026-3148 2 Haben-cs9, Sourcecodester 2 Simple And Nice Shopping Cart Script, Simple And Nice Shopping Cart Script 2026-04-17 7.3 High
A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-3149 2 Angeljudesuarez, Itsourcecode 2 College Management System, College Management System 2026-04-17 6.3 Medium
A weakness has been identified in itsourcecode College Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/asign-single-student-subjects.php. Executing a manipulation of the argument course_code can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-3150 2 Angeljudesuarez, Itsourcecode 2 College Management System, College Management System 2026-04-17 6.3 Medium
A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php. The manipulation of the argument teacher_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-3151 2 Angeljudesuarez, Itsourcecode 2 College Management System, College Management System 2026-04-17 7.3 High
A vulnerability was detected in itsourcecode College Management System 1.0. This vulnerability affects unknown code of the file /login/login.php. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
CVE-2026-3152 2 Angeljudesuarez, Itsourcecode 2 College Management System, College Management System 2026-04-17 7.3 High
A flaw has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/teacher-salary.php. This manipulation of the argument teacher_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVE-2026-3153 2 Admerc, Itsourcecode 2 Document Management System, Document Management System 2026-04-17 7.3 High
A vulnerability has been found in itsourcecode Document Management System 1.0. Impacted is an unknown function of the file /register.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-28193 1 Jetbrains 1 Youtrack 2026-04-17 8.8 High
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
CVE-2026-28195 1 Jetbrains 1 Teamcity 2026-04-17 4.3 Medium
In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations
CVE-2026-36941 1 Sourcecodester 1 Online Resort Management System 2026-04-17 2.7 Low
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php.
CVE-2026-36952 1 Sourcecodester 1 Online Thesis Archiving System 2026-04-17 2.7 Low
Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php.
CVE-2026-36950 1 Sourcecodester 1 Online Thesis Archiving System 2026-04-17 2.7 Low
Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php.
CVE-2026-36943 1 Sourcecodester 1 Computer And Mobile Repair Shop Management System 2026-04-17 2.7 Low
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php.
CVE-2026-36948 1 Sourcecodester 1 Online Thesis Archiving System 2026-04-17 7.3 High
Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php.
CVE-2026-36937 1 Sourcecodester 1 Online Resort Management System 2026-04-17 2.7 Low
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php.
CVE-2026-36945 1 Sourcecodester 1 Computer And Mobile Repair Shop Management System 2026-04-17 2.7 Low
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php
CVE-2026-36944 1 Sourcecodester 1 Computer And Mobile Repair Shop Management System 2026-04-17 2.7 Low
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php.
CVE-2026-36938 1 Sourcecodester 1 Online Resort Management System 2026-04-17 2.7 Low
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php.
CVE-2026-36942 1 Sourcecodester 1 Online Resort Management System 2026-04-17 2.7 Low
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php.
CVE-2026-32272 1 Craftcms 1 Commerce 2026-04-17 N/A
Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklist added to ElementIndexesController in a prior security fix (GHSA-2453-mppf-46cj). The blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct pass through untouched and internally call Craft::configure() on a subquery without sanitization, re-introducing SQL injection. Any authenticated control panel user can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation. This issue has been fixed in version 5.6.0.