Filtered by CWE-89
Filtered by vendor Subscriptions
Total 16485 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-12442 1 Ivanti 1 Avalanche 2024-11-21 9.8 Critical
Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250.
CVE-2020-12429 1 Phpgurukul 1 Online Course Registration 2024-11-21 9.8 Critical
Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass in the login pages: admin/change-password.php, admin/check_availability.php, admin/index.php, change-password.php, check_availability.php, includes/header.php, index.php, and pincode-verification.php.
CVE-2020-12104 1 Internet-formation 1 Wp-advanced-search 2024-11-21 8.8 High
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
CVE-2020-12034 1 Rockwellautomation 5 Eds Subsystem, Rslinx, Rslinx Enterprise and 2 more 2024-11-21 8.2 High
Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and prior) is vulnerable.The EDS subsystem does not provide adequate input sanitation, which may allow an attacker to craft specialized EDS files to inject SQL queries and manipulate the database storing the EDS files. This can lead to denial-of-service conditions.
CVE-2020-12014 1 Advantech 1 Webaccess 2024-11-21 7.5 High
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands.
CVE-2020-12013 2 Iconics, Mitsubishielectric 11 Bizviz, Energy Analytix, Facility Analytix and 8 more 2024-11-21 9.1 Critical
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
CVE-2020-11942 1 Opmantek 1 Open-audit 2024-11-21 9.8 Critical
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.
CVE-2020-11886 1 Opennms 2 Horizon, Meridian 2024-11-21 8.1 High
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.
CVE-2020-11820 1 Rukovoditel 1 Rukovoditel 2024-11-21 9.8 Critical
Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities_id parameter.
CVE-2020-11816 1 Rukovoditel 1 Rukovoditel 2024-11-21 9.8 Critical
Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports_id (POST) parameter.
CVE-2020-11812 1 Rukovoditel 1 Rukovoditel 2024-11-21 9.8 Critical
Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters[0][value] or filters[1][value] parameter.
CVE-2020-11717 1 Bilanc 1 Bilanc 2024-11-21 9.8 Critical
An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities.
CVE-2020-11597 1 Cipplanner 1 Cipace 2024-11-21 9.8 Critical
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner.
CVE-2020-11545 1 Projectworlds 1 Official Car Rental System 2024-11-21 9.8 Critical
Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters (login.php), and id parameter (book_car.php) This allows an attacker to dump the MySQL database and to bypass the login authentication prompt.
CVE-2020-11537 1 Onlyoffice 1 Document Server 2024-11-21 9.8 Critical
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API.
CVE-2020-11530 1 Idangero 1 Chop Slider 2024-11-21 9.8 Critical
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.
CVE-2020-11437 1 Librehealth 1 Librehealth Ehr 2024-11-21 4.3 Medium
LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database.
CVE-2020-11032 1 Glpi-project 1 Glpi 2024-11-21 7.6 High
In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.
CVE-2020-11010 1 Tortoise Orm Project 1 Tortoise Orm 2024-11-21 6.3 Medium
In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).
CVE-2020-11004 1 Admidio 1 Admidio 2024-11-21 7.7 High
SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.