Filtered by CWE-89
Filtered by vendor Subscriptions
Total 18487 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2012-5872 1 Arc2 Project 1 Arc2 2025-02-04 9.8 Critical
ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.
CVE-2023-27843 1 Ask For A Quote Project 1 Ask For A Quote 2025-02-03 9.8 Critical
SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component.
CVE-2023-30545 1 Prestashop 1 Prestashop 2025-02-03 7.7 High
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9
CVE-2025-22976 2025-02-03 7.1 High
SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly at the "checkOrder.php" shopId module.
CVE-2023-30211 1 Ourphp 1 Ourphp 2025-02-03 9.8 Critical
OURPHP <= 7.2.0 is vulnerable to SQL Injection.
CVE-2023-30112 1 Medicine Tracker System Project 1 Medicine Tracker System 2025-02-03 7.5 High
Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.
CVE-2023-30839 1 Prestashop 1 Prestashop 2025-02-03 10 Critical
PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.
CVE-2023-2338 1 Pimcore 1 Pimcore 2025-02-03 8.8 High
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2019-19245 1 Napc 1 Xinet Elegant 6 Asset Library 2025-02-02 9.8 Critical
NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used.
CVE-2022-4118 1 Coinmarketstats 1 Bitcoin \/ Altcoin Payment Gateway For Woocommerce 2025-02-01 9.8 Critical
The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users
CVE-2024-57775 1 Jfinaloa Project 1 Jfinaloa 2025-02-01 8.8 High
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid.
CVE-2025-0861 1 Vruiz 1 Vr-frases 2025-01-31 4.9 Medium
The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2023-37777 2025-01-31 9.8 Critical
A SQL injection vulnerability exists in Synnefo Internet Management Software (IMS) version 2023 and earlier. This vulnerability occurs due to improper input validation in a specific API endpoint parameter allowing an attacker to manipulate SQL queries via crafted input. Successful exploitation could lead to unauthorized access to database records with DB administrator privileges which can be leveraged to escalate privileges further and execute arbitrary OS commands.
CVE-2021-4134 1 Radykal 1 Fancy Product Designer 2025-01-31 7.2 High
The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.
CVE-2022-0651 1 Veronalabs 1 Wp Statistics 2025-01-31 9.8 Critical
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
CVE-2022-25149 1 Veronalabs 1 Wp Statistics 2025-01-31 9.8 Critical
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
CVE-2023-30849 1 Pimcore 1 Pimcore 2025-01-31 8.8 High
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
CVE-2024-13596 1 Modalsurvey 1 Wordpress Survey And Poll 2025-01-31 6.5 Medium
The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'survey' shortcode in all versions up to, and including, 1.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2023-26781 1 Chshcms 1 Mccms 2025-01-31 9.8 Critical
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
CVE-2024-35278 1 Fortinet 1 Fortiportal 2025-01-31 4.1 Medium
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request.