Export limit exceeded: 377395 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20224 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19384 | 1 Sourcecodester | 1 Simple Doctors Appointment System | 2026-08-10 | 7.3 High |
| A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-15361 | 2 Contentviewspro, Wordpress | 2 Content Views, Wordpress | 2026-08-08 | 8.1 High |
| The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks. | ||||
| CVE-2026-19067 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-08 | 6.3 Medium |
| A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-51775 | 1 Fastadmin | 1 Fastadmin | 2026-08-08 | 9.8 Critical |
| SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component | ||||
| CVE-2026-64636 | 1 Webpros | 1 Plesk | 2026-08-07 | 7.7 High |
| An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database. | ||||
| CVE-2026-34191 | 1 Apache | 2 Apr-util, Portable Runtime Utility | 2026-08-07 | 9.1 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3 | ||||
| CVE-2025-58375 | 2026-08-07 | 8.1 High | ||
| Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0. | ||||
| CVE-2026-19196 | 1 Sourcecodester | 1 Photo Share Website | 2026-08-07 | 7.3 High |
| A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-19070 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-07 | 6.3 Medium |
| A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument delid results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. | ||||
| CVE-2026-19069 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-07 | 6.3 Medium |
| A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-19062 | 1 Chiuwingyan | 1 House | 2026-08-07 | 7.3 High |
| A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-19068 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-07 | 6.3 Medium |
| A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Executing a manipulation of the argument patientid can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-67689 | 2026-08-07 | 9.8 Critical | ||
| SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints | ||||
| CVE-2026-19071 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-07 | 6.3 Medium |
| A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2026-66838 | 1 Elixir-ecto | 1 Postgrex | 2026-08-07 | N/A |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection's role. Ecto exposes the same option through Ecto.Repo.stream/2. Postgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained. This issue affects postgrex: from 0.19.3 before 0.22.4. | ||||
| CVE-2026-8029 | 1 Zte | 1 Smartlife | 2026-08-07 | 3.9 Low |
| The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the theft of local privacy data. | ||||
| CVE-2026-5134 | 1 Loca Software Informatics Technology | 1 Cms | 2026-08-07 | 9.8 Critical |
| Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-65546 | 2 Qode, Wordpress | 2 Qode Tours, Wordpress | 2026-08-07 | 9.3 Critical |
| Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | ||||
| CVE-2026-16532 | 2 Link Library Project, Wordpress | 2 Link Library, Wordpress | 2026-08-07 | 9.1 Critical |
| The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-16065 | 2 Welcart, Wordpress | 2 Welcart E-commerce, Wordpress | 2026-08-07 | 6.5 Medium |
| The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks. | ||||