Export limit exceeded: 20627 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20627 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-63359 | 2 Appriss Insights, Equifax | 2 Victim Information Notification Exchange (vine), Victim Information Notification Exchange | 2026-08-26 | 9.8 Critical |
| The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database. | ||||
| CVE-2026-32554 | 2026-08-25 | 9.3 Critical | ||
| Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. | ||||
| CVE-2026-75497 | 1 Webkul | 1 Qloapps | 2026-08-25 | 7.2 High |
| Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c. | ||||
| CVE-2026-75498 | 1 Webkul | 1 Qloapps | 2026-08-25 | 7.2 High |
| Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c. | ||||
| CVE-2026-53572 | 1 Kedacore | 1 Keda | 2026-08-25 | 5.9 Medium |
| KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter() only quotes values containing a literal space. Tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can therefore create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection. This issue is fixed in version 2.20.0. | ||||
| CVE-2026-15023 | 2 Netweblogic, Wordpress | 2 Events Manager, Wordpress | 2026-08-25 | 6.5 Medium |
| The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an attacker first plants SQL metacharacters in a custom meta key via the standard add-meta flow (WordPress stores these verbatim in wp_postmeta), then triggers the injection by invoking the event_duplicate or location_duplicate action, which reads the stored meta keys via get_post_meta() and concatenates them unsafely into the INSERT query. | ||||
| CVE-2026-78470 | 2026-08-25 | 6.5 Medium | ||
| The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-76635 | 1 Baserproject | 1 Basercms | 2026-08-25 | 7.2 High |
| baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend. | ||||
| CVE-2026-78864 | 1 Liketrek | 1 Trek | 2026-08-25 | 6.3 Medium |
| A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the attack remotely. Upgrading to version 3.1.0 is sufficient to fix this issue. It is recommended to upgrade the affected component. | ||||
| CVE-2026-78656 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-08-25 | 6.3 Medium |
| A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-77994 | 1 Joomlack | 1 Page Builder Ck Extension For Joomla | 2026-08-25 | N/A |
| Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model. | ||||
| CVE-2026-75986 | 1 Code-projects | 1 Online Job Portal System | 2026-08-25 | 7.3 High |
| A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-8111 | 1 Ivanti | 1 Endpoint Manager | 2026-08-24 | 8.8 High |
| SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. | ||||
| CVE-2025-46252 | 1 Kofimokome | 1 Message Filter For Contact Form 7 | 2026-08-24 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2. | ||||
| CVE-2026-51366 | 2026-08-24 | 9.9 Critical | ||
| SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter | ||||
| CVE-2026-70818 | 1 Oracle | 1 Hyperion Financial Management | 2026-08-24 | 8.8 High |
| Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-73345 | 2 Saad Iqbal, Wordpress | 2 License Manager For Woocommerce, Wordpress | 2026-08-24 | 7.1 High |
| Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions. | ||||
| CVE-2026-73365 | 2 Crocoblock. Jetimpex Inc., Wordpress | 2 Jetappointment, Wordpress | 2026-08-24 | 9.3 Critical |
| Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. | ||||
| CVE-2026-78200 | 1 Itsourcecode | 1 Library Management System | 2026-08-24 | 6.3 Medium |
| A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. | ||||
| CVE-2026-32471 | 2 Themebing, Wordpress | 2 Prolancer Element, Wordpress | 2026-08-24 | 8.5 High |
| Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions. | ||||