Export limit exceeded: 334961 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17911 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-36972 | 1 Smartdatasoft | 1 Smartblog | 2026-02-09 | 8.2 High |
| SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database information. Attackers can systematically test and retrieve database contents by injecting crafted SQL queries that compare character-by-character of database information. | ||||
| CVE-2019-25303 | 1 Thejshen | 1 Contentmanagementsystem | 2026-02-09 | 7.1 High |
| TheJshen ContentManagementSystem 1.04 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to extract or manipulate database information by crafting malicious query payloads. | ||||
| CVE-2019-25299 | 1 Rimbalinux | 1 Ahadpos | 2026-02-09 | 7.1 High |
| RimbaLinux AhadPOS 1.11 contains a SQL injection vulnerability in the 'alamatCustomer' parameter that allows attackers to manipulate database queries through crafted POST requests. Attackers can exploit time-based and boolean-based blind SQL injection techniques to extract information or potentially interact with the underlying database. | ||||
| CVE-2019-25300 | 1 Thejshen | 1 Globitek Cms | 2026-02-09 | 7.1 High |
| thejshen Globitek CMS 1.4 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or modify database information. | ||||
| CVE-2026-22044 | 1 Glpi-project | 1 Glpi | 2026-02-06 | 6.5 Medium |
| GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23. | ||||
| CVE-2020-37105 | 1 Redmine | 1 Pmb | 2026-02-06 | 7.1 High |
| PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the /admin/sauvegarde/download.php endpoint with manipulated logid values to interact with the database. | ||||
| CVE-2020-37108 | 1 Allhandsmarketing | 1 Phpix 2012 Professional | 2026-02-06 | 7.1 High |
| PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the 'id' parameter to potentially extract or modify database information. | ||||
| CVE-2025-5553 | 1 Phpgurukul | 1 Rail Pass Management System | 2026-02-06 | 7.3 High |
| A vulnerability classified as critical was found in PHPGurukul Rail Pass Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /download-pass.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2022-44151 | 1 Sanitization Management System Project | 1 Sanitization Management System | 2026-02-06 | 9.8 Critical |
| Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php. | ||||
| CVE-2024-36597 | 1 Projectworlds | 1 Life Insurance Management System | 2026-02-06 | 8.8 High |
| Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php. | ||||
| CVE-2023-51951 | 1 Stock Management System Project | 1 Stock Management System | 2026-02-06 | 9.8 Critical |
| SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id parameter in the manage_bo.php file. | ||||
| CVE-2022-2421 | 1 Socket | 1 Socket.io-parser | 2026-02-06 | 10 Critical |
| Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. | ||||
| CVE-2025-13774 | 1 Progress | 2 Flowmon, Flowmon Anomaly Detection System | 2026-02-05 | 8.8 High |
| A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands. | ||||
| CVE-2026-25234 | 1 Pear | 1 Pearweb | 2026-02-05 | 9.8 Critical |
| PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow an attacker with access to the category manager workflow to inject SQL via a category id. This issue has been patched in version 1.33.0. | ||||
| CVE-2026-25236 | 1 Pear | 1 Pearweb | 2026-02-05 | 9.8 Critical |
| PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN (...) list. This issue has been patched in version 1.33.0. | ||||
| CVE-2026-25238 | 1 Pear | 1 Pearweb | 2026-02-05 | 9.8 Critical |
| PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion may allow attackers to inject SQL via a crafted email value. This issue has been patched in version 1.33.0. | ||||
| CVE-2026-25239 | 1 Pear | 1 Pearweb | 2026-02-05 | 7.5 High |
| PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can allow query manipulation if an attacker can influence the inserted filename value. This issue has been patched in version 1.33.0. | ||||
| CVE-2026-25240 | 1 Pear | 1 Pearweb | 2026-02-05 | 9.8 Critical |
| PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains() when role filters are provided as an array and interpolated into an IN (...) clause. This issue has been patched in version 1.33.0. | ||||
| CVE-2026-25241 | 1 Pear | 1 Pearweb | 2026-02-05 | 9.8 Critical |
| PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<version> endpoint allows remote attackers to execute arbitrary SQL via a crafted package version. This issue has been patched in version 1.33.0. | ||||
| CVE-2025-57792 | 1 Explorance | 1 Blue | 2026-02-05 | 10 Critical |
| Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication, significantly raising the risk. | ||||