Export limit exceeded: 374311 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20113 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-5134 | 1 Loca Software Informatics Technology | 1 Cms | 2026-08-07 | 9.8 Critical |
| Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-65546 | 2 Qode, Wordpress | 2 Qode Tours, Wordpress | 2026-08-07 | 9.3 Critical |
| Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | ||||
| CVE-2026-16532 | 2 Link Library Project, Wordpress | 2 Link Library, Wordpress | 2026-08-07 | 9.1 Critical |
| The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-16065 | 2 Welcart, Wordpress | 2 Welcart E-commerce, Wordpress | 2026-08-07 | 6.5 Medium |
| The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks. | ||||
| CVE-2026-12713 | 2 Arni Cinco, Wordpress | 2 Wpcargo Track & Trace, Wordpress | 2026-08-07 | 9.1 Critical |
| The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004. | ||||
| CVE-2026-34191 | 1 Apache | 1 Portable Runtime Utility | 2026-08-06 | 9.1 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3 | ||||
| CVE-2026-19067 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-06 | 6.3 Medium |
| A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-65321 | 1 Laughingman7743 | 1 Pyathena | 2026-08-06 | 9.8 Critical |
| PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker-supplied input such as a single quote followed by SQL syntax causes the parser to terminate the string literal prematurely, enabling data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content. | ||||
| CVE-2026-19020 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-06 | 6.3 Medium |
| A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-3430 | 2026-08-06 | 8.6 High | ||
| The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail. | ||||
| CVE-2026-65520 | 2 Miniorange, Wordpress | 2 Wp Oauth Server, Wordpress | 2026-08-06 | 9.3 Critical |
| Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | ||||
| CVE-2026-65547 | 2 Constantcontact, Wordpress | 2 Creative Mail, Wordpress | 2026-08-06 | 8.5 High |
| Subscriber SQL Injection in Creative Mail <= 1.6.9 versions. | ||||
| CVE-2026-65508 | 2 Nsquared, Wordpress | 2 Simply Schedule Appointments, Wordpress | 2026-08-06 | 9.3 Critical |
| Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. | ||||
| CVE-2026-65569 | 2 Wordpress, Wpjobportal | 2 Wordpress, Wp Job Portal | 2026-08-06 | 8.5 High |
| Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions. | ||||
| CVE-2026-66447 | 2026-08-06 | 9.3 Critical | ||
| Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. | ||||
| CVE-2026-18958 | 1 Imranrisal-dev | 1 Student-management-system | 2026-08-06 | 7.3 High |
| A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-18970 | 1 Rongzhitong | 1 Visual Integrated Command And Dispatch Platform | 2026-08-06 | 7.3 High |
| A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-19021 | 1 Sourcecodester | 1 Computer Repair Shop Management System | 2026-08-06 | 7.3 High |
| A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-51992 | 1 Clickhouse | 1 Clickhouse | 2026-08-06 | 9.1 Critical |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on the downstream PostgreSQL server using credentials explicitly provided by the user with specific pg_execute_server_program permission, exploiting a feature that was wrongly reported as CVE-2019-9193 in PostgreSQL (https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/). | ||||
| CVE-2026-24552 | 2 Mischiefmarmot, Wordpress | 2 Create By Mediavine, Wordpress | 2026-08-06 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3. | ||||