Vulnerabilities (CVE)

Filtered by CWE-89
Total 15514 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-19245 1 Napc 1 Xinet Elegant 6 Asset Library 2025-02-02 7.5 HIGH 9.8 CRITICAL
NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used.
CVE-2022-4118 1 Coinmarketstats 1 Bitcoin \/ Altcoin Payment Gateway For Woocommerce 2025-01-31 N/A 9.8 CRITICAL
The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users
CVE-2024-57775 1 Jfinaloa Project 1 Jfinaloa 2025-01-31 N/A 8.8 HIGH
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid.
CVE-2025-0861 1 Vruiz 1 Vr-frases 2025-01-31 N/A 4.9 MEDIUM
The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2023-37777 2025-01-31 N/A 9.8 CRITICAL
A SQL injection vulnerability exists in Synnefo Internet Management Software (IMS) version 2023 and earlier. This vulnerability occurs due to improper input validation in a specific API endpoint parameter allowing an attacker to manipulate SQL queries via crafted input. Successful exploitation could lead to unauthorized access to database records with DB administrator privileges which can be leveraged to escalate privileges further and execute arbitrary OS commands.
CVE-2024-13596 1 Modalsurvey 1 Wordpress Survey And Poll 2025-01-31 N/A 6.5 MEDIUM
The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'survey' shortcode in all versions up to, and including, 1.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2023-26813 1 Wang.market 1 Wangmarket Cms 2025-01-31 N/A 9.8 CRITICAL
SQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller.DataDictionaryPluginController.java in wangmarket CMS 4.10 allows remote attackers to run arbitrary SQL commands via the TableName parameter to /plugin/dataDictionary/tableView.do.
CVE-2023-26781 1 Chshcms 1 Mccms 2025-01-31 N/A 9.8 CRITICAL
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
CVE-2024-35278 1 Fortinet 1 Fortiportal 2025-01-31 N/A 4.3 MEDIUM
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request.
CVE-2024-35275 1 Fortinet 4 Fortianalyzer, Fortianalyzer Cloud, Fortimanager and 1 more 2025-01-31 N/A 6.6 MEDIUM
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.
CVE-2023-33361 1 Piwigo 1 Piwigo 2025-01-31 N/A 9.8 CRITICAL
Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
CVE-2023-33338 1 Phpgurukul 1 Old Age Home Management System 2025-01-31 N/A 9.8 CRITICAL
Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.
CVE-2024-13236 1 Tainacan 1 Tainacan 2025-01-31 N/A 6.5 MEDIUM
The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collection_id' parameter in all versions up to, and including, 0.21.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2023-30149 2 Ebewe, Prestashop 2 City Autocomplete, Prestashop 2025-01-31 N/A 9.8 CRITICAL
SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller.
CVE-2025-0929 2025-01-31 N/A 9.8 CRITICAL
SQL injection vulnerability in TeamCal Neo, version 3.8.2. This could allow an attacker to retrieve, update and delete all database information by injecting a malicious SQL statement via the ‘abs’ parameter in ‘/teamcal/src/index.php’.
CVE-2023-31615 1 Openlinksw 1 Virtuoso 2025-01-31 N/A 7.5 HIGH
An issue in the chash_array component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31614 1 Openlinksw 1 Virtuoso 2025-01-31 N/A 7.5 HIGH
An issue in the mp_box_deserialize_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.
CVE-2023-29630 1 Joommasters 1 Jms Drop Mega Menu 2025-01-31 N/A 9.8 CRITICAL
PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax_jmsmegamenu.php.
CVE-2023-29629 1 Jmsthemelayout Project 1 Jmsthemelayout 2025-01-31 N/A 9.8 CRITICAL
PrestaShop jmsthemelayout 2.5.5 is vulnerable to SQL Injection via ajax_jmsvermegamenu.php.
CVE-2024-2342 1 Nsquared 1 Simply Schedule Appointments 2025-01-31 N/A 8.8 HIGH
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.