Filtered by CWE-89
Filtered by vendor Subscriptions
Total 18533 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-27568 1 Spryker 1 Commerce Os 2025-02-13 8.8 High
SQL injection vulnerability inSpryker Commerce OS 0.9 that allows for access to sensitive data via customer/order?orderSearchForm[searchText]=
CVE-2023-26876 1 Piwigo 1 Piwigo 2025-02-13 8.8 High
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
CVE-2023-2636 1 An Gradebook Project 1 An Gradebook 2025-02-13 8.8 High
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
CVE-2023-0620 2 Hashicorp, Redhat 3 Vault, Openshift, Openshift Data Foundation 2025-02-13 6.5 Medium
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.
CVE-2022-34265 2 Djangoproject, Redhat 4 Django, Rhui, Satellite and 1 more 2025-02-13 9.8 Critical
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
CVE-2022-28347 3 Debian, Djangoproject, Redhat 6 Debian Linux, Django, Ansible Automation Platform and 3 more 2025-02-13 9.8 Critical
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
CVE-2022-28346 3 Debian, Djangoproject, Redhat 7 Debian Linux, Django, Ansible Automation Platform and 4 more 2025-02-13 9.8 Critical
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
CVE-2023-26856 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-02-13 7.2 High
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login.
CVE-2023-26750 1 Yiiframework 1 Yii 2025-02-13 9.8 Critical
SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework.
CVE-2015-9457 1 Caseproof 1 Prettylinks 2025-02-13 7.2 High
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
CVE-2024-36779 1 Stock Management System Project 1 Stock Management System 2025-02-13 9.8 Critical
Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php.
CVE-2024-36673 1 Pharmacy\/medical Store Point Of Sale System Project 1 Pharmacy\/medical Store Point Of Sale System 2025-02-13 9.8 Critical
Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries.
CVE-2024-35563 1 Cdg 1 Server 2025-02-13 9.8 Critical
CDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermissions.
CVE-2024-35548 2025-02-13 5.4 Medium
A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection.
CVE-2024-35361 1 Mtab 1 Bookmark 2025-02-13 9.8 Critical
MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. An attacker can execute arbitrary SQL statements through this vulnerability without requiring any user rights.
CVE-2024-35359 1 Dino Physics School Assistant Project 1 Dino Physics School Assistant 2025-02-13 5.4 Medium
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=view_item. Manipulating the argument id can result in SQL injection.
CVE-2024-35349 1 Dino Physics School Assistant Project 1 Dino Physics School Assistant 2025-02-13 9.8 Critical
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /admin/category/view_category.php. Manipulating the argument id can result in SQL injection.
CVE-2024-34310 1 Bjjfsd 1 Jin Fang Times Content Management System 2025-02-13 8.8 High
Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter.
CVE-2024-30801 1 Beijing Xinwang Medical Information Technology 1 Cloud Based Customer Service Management Platform 2025-02-13 5.5 Medium
SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code via a crafted payload to Login.asp component.
CVE-2022-28132 1 T-soft 1 E-commerce 2025-02-13 7.2 High
The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication mechanisms, view sensitive information stored in the database, and potentially exfiltrate data.