Export limit exceeded: 20977 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20977 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87105 | 1 Tanium | 1 Threat Response | 2026-09-18 | 8.8 High |
| Tanium addressed a SQL injection vulnerability in Threat Response. | ||||
| CVE-2026-87024 | 1 Tanium | 1 Asset | 2026-09-18 | 7.2 High |
| Tanium addressed a SQL injection vulnerability in Asset. | ||||
| CVE-2026-66580 | 2 Rextheme, Wordpress | 2 Product Feed Manager, Wordpress | 2026-09-17 | 8.5 High |
| Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. | ||||
| CVE-2026-66625 | 2 Wcvendors, Wordpress | 2 Wc Vendors Marketplace, Wordpress | 2026-09-17 | 7.6 High |
| Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. | ||||
| CVE-2026-76461 | 1 Cisco | 8 Asyncos, Secure Email, Secure Email Gateway C195 and 5 more | 2026-09-17 | 9.8 Critical |
| A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system. | ||||
| CVE-2026-92465 | 2 Themehunk, Wordpress | 2 Mega Menu, Wordpress | 2026-09-17 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2. | ||||
| CVE-2026-66628 | 2 Wordpress, Wplab | 2 Wordpress, Wp-lister Lite For Ebay | 2026-09-17 | 7.6 High |
| Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions. | ||||
| CVE-2026-92926 | 1 Code-projects | 1 Matrimonial System | 2026-09-17 | 7.3 High |
| A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-79752 | 1 Cakephp | 1 Cakephp | 2026-09-17 | N/A |
| CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7. | ||||
| CVE-2026-89180 | 1 Thinkingsoftware | 1 Efence | 2026-09-17 | 7.5 High |
| EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents. | ||||
| CVE-2026-16588 | 2 Wordpress, Wpdirectorykit | 2 Wordpress, Wp Directory Kit | 2026-09-17 | 6.5 Medium |
| The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-78472 | 2026-09-17 | 8.6 High | ||
| The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-76557 | 2026-09-17 | 6.8 Medium | ||
| The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks. | ||||
| CVE-2026-76556 | 2026-09-17 | 6.8 Medium | ||
| The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks. | ||||
| CVE-2026-44172 | 2 Mariadb, Redhat | 3 Mariadb, Server, Enterprise Linux | 2026-09-17 | 9.1 Critical |
| MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9. | ||||
| CVE-2026-8462 | 1 Openmeter | 1 Openmeter | 2026-09-17 | N/A |
| SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to meters API. | ||||
| CVE-2026-81567 | 1 J2commerce.com | 1 J2store Extension For Joomla | 2026-09-16 | N/A |
| Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content (e.g. customer records, order data, stored credentials/tokens) via boolean- or time-based inference, reachable on any public storefront that exposes the standard product listing or product-tags filter. | ||||
| CVE-2026-92405 | 1 Sourcecodester | 1 Inventory And Monitoring System | 2026-09-16 | 7.3 High |
| A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-92366 | 1 Code-projects | 1 Matrimonial System | 2026-09-16 | 7.3 High |
| A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipulation of the argument sex/mothertongue/maritialstatus/country/state/religion/agemin/agemax causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-92406 | 1 Sourcecodester | 1 Inventory And Monitoring System | 2026-09-16 | 7.3 High |
| A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/btn_functions.php?action=add. Performing a manipulation of the argument difficulty_id results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. | ||||