Export limit exceeded: 10074 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 20746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20746 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62109 | 2 Wordpress, Wowdevs | 2 Wordpress, Sky Addons For Elementor | 2026-09-13 | 7.6 High |
| Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions. | ||||
| CVE-2026-84047 | 2026-09-12 | 8.6 High | ||
| The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-80491 | 2026-09-12 | 8.6 High | ||
| The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks. | ||||
| CVE-2026-86310 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-09-11 | 6.3 Medium |
| A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-86268 | 1 Itsourcecode | 1 School Management System | 2026-09-11 | 7.3 High |
| A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. | ||||
| CVE-2026-86236 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-09-11 | 6.3 Medium |
| A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/pro_transac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-86224 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-09-11 | 7.3 High |
| A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-86172 | 1 Defaultfuction | 1 Crm | 2026-09-11 | 6.3 Medium |
| A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2026-86161 | 1 Sourcecodester | 1 Online Voting System | 2026-09-11 | 7.3 High |
| A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. | ||||
| CVE-2026-85516 | 1 Code-projects | 1 Vehicle Management System | 2026-09-11 | 7.3 High |
| A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2026-85402 | 1 Code-projects | 1 Doctor Appointment System | 2026-09-11 | 7.3 High |
| A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-85383 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-09-11 | 6.3 Medium |
| A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. | ||||
| CVE-2026-18561 | 2 Unitecms, Wordpress | 2 Unlimited Elements For Elementor, Wordpress | 2026-09-11 | 7.5 High |
| The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-88890 | 1 Openpanel | 1 Openpanel | 2026-09-11 | 8.5 High |
| OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques. | ||||
| CVE-2026-75746 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-09-11 | 9.1 Critical |
| ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-77098 | 1 Commvault | 1 Commvault | 2026-09-11 | 9.8 Critical |
| Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server. | ||||
| CVE-2026-9163 | 1 Gis Informatics | 1 Gislab Laboratory Management System | 2026-09-11 | 9.8 Critical |
| Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5. | ||||
| CVE-2026-71808 | 2026-09-11 | 8.8 High | ||
| A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java). | ||||
| CVE-2026-62895 | 1 Microsoft | 1 Azure Arc Sql Server Extension | 2026-09-10 | 8.8 High |
| Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-19944 | 2 Themeum, Wordpress | 2 Wp Crowdfunding, Wordpress | 2026-09-10 | 4.9 Medium |
| The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Shop Manager writes the malicious payload once via the WooCommerce REST products endpoint (POST/PUT /wp-json/wc/v3/products/{id}), and the injected query executes on every subsequent public page view that renders the campaign rewards sidebar. | ||||