Filtered by CWE-89
Filtered by vendor Subscriptions
Total 13418 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-6479 2024-11-01 6.5 Medium
The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'no_of_reviews' attribute in the woocommerce_reviews shortcode in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2024-6480 2024-11-01 6.4 Medium
The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'no_of_reviews' attribute in the woocommerce_reviews shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-48573 1 Aquila 1 Cms 2024-11-01 9.8 Critical
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature.
CVE-2024-48307 1 Jeecg 1 Jeecgboot 2024-11-01 9.8 Critical
JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.
CVE-2024-46531 1 Phpgurukul 1 Vehicle Record Management System 2024-11-01 6.3 Medium
phpgurukul Vehicle Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchinputdata parameter at /index.php.
CVE-2024-10331 1 Phpgurukul 1 Vehicle Record System 2024-11-01 6.3 Medium
A vulnerability, which was classified as critical, has been found in PHPGurukul Vehicle Record System 1.0. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchinputdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-7042 2 Langchain, Langchain-ai 2 Langchain, Langchainjs 2024-10-31 9.8 Critical
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
CVE-2024-48230 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.
CVE-2024-48229 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.
CVE-2024-48223 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.
CVE-2024-48222 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.
CVE-2024-48218 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.
CVE-2024-48226 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.
CVE-2024-50479 1 Mansurahamed 1 Woocommerce Quote Calculator 2024-10-31 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mansur Ahamed Woocommerce Quote Calculator allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through 1.1.
CVE-2024-10449 1 Codezips 1 Hospital Appointment System 2024-10-31 7.3 High
A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-50465 1 Squirrly 1 Premium Seo Pack 2024-10-31 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP SEO – Calin Vingan Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 1.6.001.
CVE-2024-10447 1 Projectworlds 1 Online Time Table Generator 2024-10-31 6.3 Medium
A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument n leads to sql injection. The attack can be launched remotely.
CVE-2024-10440 2 Sun.net, Sunnet 2 Ehdr Ctms, Ehrd Ctms 2024-10-31 9.8 Critical
The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and delete database contents.
CVE-2024-48427 2 Oretnom23, Sourcecodester 2 Packers And Movers Management System, Packers And Movers Management System 2024-10-31 8.1 High
A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manage_service&id
CVE-2024-47483 1 Dell 1 Data Lakehouse 2024-10-31 2.9 Low
Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.