Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17787 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-24956 1 Forget Heart Message Box Project 1 Forget Heart Message Box 2025-03-27 8.8 High
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php.
CVE-2023-24241 1 Forget Heart Message Box Project 1 Forget Heart Message Box 2025-03-27 9.8 Critical
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
CVE-2022-47780 1 Bangresto Project 1 Bangresto 2025-03-27 9.8 Critical
SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.
CVE-2024-25351 1 Phpgurukul 1 Zoo Management System 2025-03-27 3.8 Low
SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid parameter.
CVE-2023-22900 1 Thinkingsoftware 1 Efence 2025-03-27 9.8 Critical
Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
CVE-2023-45860 1 Hazelcast 1 Hazelcast 2025-03-27 6.5 Medium
In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.
CVE-2022-46965 1 202-ecommerce 1 Administrative Mandate 2025-03-27 8.1 High
PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.
CVE-2021-36503 1 Native-php-cms Project 1 Native-php-cms 2025-03-27 9.8 Critical
SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file.
CVE-2024-9574 1 Soplanning 1 Soplanning 2025-03-27 9.8 Critical
SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB.
CVE-2024-9573 1 Soplanning 1 Soplanning 2025-03-27 6.3 Medium
SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter, which could allow a remote user to send a specially crafted query and extract all the information stored on the server.
CVE-2025-0723 1 Metagauss 1 Profilegrid 2025-03-27 6.5 Medium
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-2625 1 Westboy 1 Cicadascms 2025-03-27 6.3 Medium
A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /system/cms/content/page. The manipulation of the argument orderField/orderDirection leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-42913 1 Ruoyi 1 Ruoyi 2025-03-26 5.4 Medium
RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.
CVE-2023-41014 1 Code-projects 1 Online Job Portal 2025-03-26 9.8 Critical
code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer."
CVE-2024-25227 1 Abocms 1 Abo.cms 2025-03-26 6.5 Medium
SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via the tb_login parameter in admin login page.
CVE-2022-48114 1 Ruoyi 1 Ruoyi 2025-03-26 9.8 Critical
RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
CVE-2022-48082 1 Easyone 1 Easyone Crm 2025-03-26 9.8 Critical
Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
CVE-2022-45589 1 Talend 1 Esb Runtime 2025-03-26 7.2 High
All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning service only. Users of the provisioning service should upgrade to either 8.0.1-R2022-10-RT or 7.3.1-R2022-09-RT or a later release and use it in place of the previous version.
CVE-2021-37316 1 Asus 2 Rt-ac68u, Rt-ac68u Firmware 2025-03-26 7.5 High
SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow.
CVE-2025-2624 1 Westboy 1 Cicadascms 2025-03-26 6.3 Medium
A vulnerability was found in westboy CicadasCMS 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /system/cms/content/save. The manipulation of the argument content/fujian/laiyuan leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.