Export limit exceeded: 20613 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20613 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85379 | 1 Light0011 | 1 Cms | 2026-09-04 | 7.3 High |
| A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterModel::searchChapter of the file App/Home/Controller/ChapterController.class.php of the component Query Builder. The manipulation of the argument content results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-84813 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-09-04 | 9.3 Critical |
| Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. | ||||
| CVE-2026-82527 | 1 Sciphi-ai | 1 R2r | 2026-09-04 | 7.5 High |
| R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping to perform time-based and boolean-based data exfiltration from the application database. | ||||
| CVE-2026-82526 | 1 Sciphi-ai | 1 R2r | 2026-09-04 | 9.8 Critical |
| R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account. | ||||
| CVE-2026-82186 | 2026-09-04 | 4.1 Medium | ||
| The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks. | ||||
| CVE-2026-85516 | 1 Code-projects | 1 Vehicle Management System | 2026-09-04 | 7.3 High |
| A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2024-7837 | 1 Firmanet | 1 Erp | 2026-09-04 | 8.2 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Firmanet Software ERP allows SQL Injection. This issue affects ERP: before 15.0.1. | ||||
| CVE-2026-81286 | 2 Wclovers, Wordpress | 2 Wcfm Marketplace, Wordpress | 2026-09-04 | 9.3 Critical |
| Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. | ||||
| CVE-2026-85402 | 1 Code-projects | 1 Doctor Appointment System | 2026-09-04 | 7.3 High |
| A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-85383 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-09-04 | 6.3 Medium |
| A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. | ||||
| CVE-2026-85138 | 1 Seacms | 1 Seacms | 2026-09-03 | 7.3 High |
| A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-85388 | 1 Worklenz | 1 Worklenz | 2026-09-03 | 8.1 High |
| Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947. | ||||
| CVE-2026-85205 | 1 Itsourcecode | 1 Online Medicine Delivery System | 2026-09-03 | 6.3 Medium |
| A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated remotely. | ||||
| CVE-2026-84768 | 2 E4jvikwp, Wordpress | 2 Vikappointments Services Booking Calendar, Wordpress | 2026-09-03 | 9.3 Critical |
| Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions. | ||||
| CVE-2026-77790 | 2 Registrationmagic, Wordpress | 2 Registrationmagic, Wordpress | 2026-09-03 | 5.5 Medium |
| The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks. | ||||
| CVE-2026-72775 | 1 N8n | 1 N8n | 2026-09-03 | 8.8 High |
| n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential's privileges, allowing full read and write access. | ||||
| CVE-2026-78080 | 1 Joodb.feenders.de | 1 Joodatabase Lite Extension For Joomla | 2026-09-03 | N/A |
| Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors. | ||||
| CVE-2026-76848 | 1 Typeorm | 1 Typeorm | 2026-09-03 | 7.5 High |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-85155 | 1 Wwbn | 1 Avideo | 2026-09-03 | 7.5 High |
| WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema. | ||||
| CVE-2026-76176 | 1 Ocs Inventory Ng | 1 Ocsreports | 2026-09-03 | N/A |
| SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database. | ||||