Filtered by CWE-89
Filtered by vendor Subscriptions
Total 17328 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-0349 1 Wpdeveloper 1 Notificationx 2024-11-21 9.8 Critical
The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
CVE-2022-0332 1 Moodle 1 Moodle 2024-11-21 9.8 Critical
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
CVE-2022-0267 1 Adrotate Project 1 Adrotate 2024-11-21 7.2 High
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
CVE-2022-0258 1 Pimcore 1 Pimcore 2024-11-21 8.8 High
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-0255 1 Deliciousbrains 1 Database Backup 2024-11-21 7.2 High
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
CVE-2022-0254 1 Highfivery 1 Zero-spam 2024-11-21 9.8 Critical
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
CVE-2022-0228 1 Sygnoos 1 Popup Builder 2024-11-21 7.2 High
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
CVE-2022-0224 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 9.8 Critical
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-0190 1 Acnam 1 Ad Invalid Click Protector 2024-11-21 8.8 High
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action.
CVE-2022-0169 1 10web 1 Photo Gallery 2024-11-21 9.8 Critical
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
CVE-2022-0153 1 Fork-cms 1 Fork Cms 2024-11-21 7.5 High
SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.
CVE-2021-4313 1 Nethserver-phonenehome Project 1 Nethserver-phonenehome 2024-11-21 5.5 Medium
A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d493836bbdf695cf71624b377391. It is recommended to apply a patch to fix this issue. The identifier VDB-218393 was assigned to this vulnerability.
CVE-2021-4301 1 Phpwcms 1 Phpwcms 2024-11-21 6.3 Medium
A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is identified as 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability.
CVE-2021-4208 1 Exportfeed 1 Exportfeed 2024-11-21 7.2 High
The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users
CVE-2021-4088 1 Mcafee 1 Data Loss Prevention 2024-11-21 8.4 High
SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.
CVE-2021-46459 1 Victor Cms Project 1 Victor Cms 2024-11-21 7.5 High
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be exploited through a crafted POST request via the user_name, user_firstname,user_lastname, or user_email parameters.
CVE-2021-46458 1 Victor Cms Project 1 Victor Cms 2024-11-21 7.5 High
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited through a crafted POST request via the post_title parameter.
CVE-2021-46451 1 Online Project Time Management System Project 1 Online Project Time Management System 2024-11-21 9.8 Critical
An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file function.
CVE-2021-46448 1 Hhg-multistore 1 Multistore 2024-11-21 9.8 Critical
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.
CVE-2021-46446 1 Hhg-multistore 1 Multistore 2024-11-21 9.8 Critical
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID.