Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17063 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-18251 1 Deltek 1 Vision 2024-11-21 N/A
Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Vision system relies on the client binary to enforce security rules and integrity of SQL statements and other content being sent to the server. Client HTTP calls can be manipulated by one of several means to execute arbitrary SQL statements (similar to SQLi) or possibly have unspecified other impact via this custom protocol. To perform these attacks an authenticated session is first required. In some cases client calls are obfuscated by encryption, which can be bypassed due to hard-coded keys and an insecure key rotation protocol. Impacts may include remote code execution in some deployments; however, the vendor states that this cannot occur when the installation documentation is heeded.
CVE-2018-18242 1 Youke365 1 Youke 365 2024-11-21 N/A
youke365 v1.1.5 has SQL injection via admin/login.html, as demonstrated by username=admin&pass=123456&code=9823&act=login&submit=%E7%99%BB+%E9%99%86.
CVE-2018-18211 1 Pbootcms 1 Pbootcms 2024-11-21 N/A
PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.
CVE-2018-18200 1 Redaxo 1 Redaxo 2024-11-21 N/A
There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.
CVE-2018-18084 1 Comsenz 1 Duomicms 2024-11-21 9.8 Critical
An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter.
CVE-2018-18075 1 Wikidforum Project 1 Wikidforum 2024-11-21 N/A
WikidForum 2.20 has SQL Injection via the rpc.php parent_post_id or num_records parameter, or the index.php?action=search select_sort parameter.
CVE-2018-18018 1 Tribulant 1 Slideshow Gallery 2024-11-21 N/A
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2018-17988 1 Layerbb 1 Layerbb 2024-11-21 9.8 Critical
LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.
CVE-2018-17852 1 Wuzhi Cms Project 1 Wuzhi Cms 2024-11-21 N/A
A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detail_listing URI.
CVE-2018-17843 1 Mlmsoftwarez 10 Add Clicking Mlm Software, Autopool Mlm Software, Bidding Mlm Software and 7 more 2024-11-21 N/A
SQL injection exists in ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Investment MLM Software 1.0, Bidding MLM Software 1.0, Moneyorder MLM Software 1.0, Repurchase MLM Software 1.0, and Gift MLM Software 1.0 via the member/readmsg.php msg_id parameter, the member/tree.php pid parameter, or the member/downline.php m_id parameter.
CVE-2018-17842 1 Scriptzee 1 Hotel Booking Engine 2024-11-21 9.8 Critical
SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels h_room_type parameter.
CVE-2018-17841 1 Flippa Marketplace Clone Project 1 Flippa Marketplace Clone 2024-11-21 N/A
SQL injection exists in Scriptzee Flippa Marketplace Clone 1.0 via the site-search sortBy or sortDir parameter.
CVE-2018-17840 1 Education Website Project 1 Education Website 2024-11-21 N/A
SQL injection exists in Scriptzee Education Website 1.0 via the college_list.html subject, city, or country parameter.
CVE-2018-17831 1 Redaxo 1 Redaxo 2024-11-21 N/A
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rex_list were used.
CVE-2018-17796 1 Mushroom Content Management System Project 1 Mushroom Content Management System 2024-11-21 N/A
An issue was discovered in MRCMS (aka mushroom) through 3.1.2. The WebParam.java file directly accepts the FIELD_T parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel() in the ChannelService.java file.
CVE-2018-17575 1 Swa 1 Swa.jacad 2024-11-21 N/A
SWA SWA.JACAD 3.1.37 Build 024 has SQL Injection via the /academico/aluno/esqueci-minha-senha/ studentId parameter.
CVE-2018-17566 1 Thinkphp 1 Thinkphp 2024-11-21 N/A
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
CVE-2018-17562 1 Multitech 1 Faxfinder 2024-11-21 N/A
Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/call_details?oid= URI, allowing an attacker to extract the underlying database schema to further disclose other fax server information through different injection points.
CVE-2018-17552 1 Naviwebs 1 Navigate Cms 2024-11-21 N/A
SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.
CVE-2018-17542 1 Hgiga 1 Oaklouds Mailsherlock 2024-11-21 N/A
SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the enterprise via the select_mid parameter in an letgo.cgi request.