Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17093 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-25034 1 Fireeye 2 Email Malware Protection System, Ex 3500 2024-11-21 6.5 Medium
eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, search{URL], or search[attachment] parameter to the email search feature.
CVE-2020-25006 1 Heybbs Project 1 Heybbs 2024-11-21 9.8 Critical
Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code.
CVE-2020-25005 1 Heybbs Project 1 Heybbs 2024-11-21 9.8 Critical
Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary code.
CVE-2020-25004 1 Heybbs Project 1 Heybbs 2024-11-21 9.8 Critical
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code.
CVE-2020-24950 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 8.8 High
SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.
CVE-2020-24932 1 Sourcecodester 1 Complaint Management System 2024-11-21 9.8 Critical
An SQL Injection vulnerability exists in Sourcecodester Complaint Management System 1.0 via the cid parameter in complaint-details.php.
CVE-2020-24913 1 Qcubed 1 Qcubed 2024-11-21 9.8 Critical
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
CVE-2020-24877 1 Zzzcms 1 Zzzphp 2024-11-21 9.8 Critical
A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.
CVE-2020-24862 1 Pharmacy Medical Store And Sale Point Project 1 Pharmacy Medical Store And Sale Point 2024-11-21 7.5 High
The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventories.php path which allows attackers to retrieve all databases.
CVE-2020-24841 1 Sdg 1 Pnpscada 2024-11-21 9.8 Critical
PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVE-2020-24791 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 9.8 Critical
FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVE-2020-24770 1 Nexusphp 1 Nexusphp 2024-11-21 9.8 Critical
SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2020-24769 1 Nexusphp 1 Nexusphp 2024-11-21 9.8 Critical
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.
CVE-2020-24673 1 Abb 2 Symphony \+ Historian, Symphony \+ Operations 2024-11-21 9.8 Critical
In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability.
CVE-2020-24671 1 Tracefinanacial 1 Crestbridge 2024-11-21 8.8 High
Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.
CVE-2020-24667 1 Tracefinanacial 1 Crestbridge 2024-11-21 8.8 High
Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.
CVE-2020-24623 1 Hpe 1 Universal Api Framework 2024-11-21 6.5 Medium
A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to allow SQL injection in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V (VHD).
CVE-2020-24617 1 Mailtrain 1 Mailtrain 2024-11-21 8.8 High
Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped.
CVE-2020-24593 1 Mitel 1 Micloud Management Portal 2024-11-21 7.2 High
Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper input validation.
CVE-2020-24569 1 Mbconnectline 2 Mbconnect24, Mymbconnect24 2024-11-21 4.3 Medium
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information.