Export limit exceeded: 20214 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20214 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-66478 2 Andymoyle, Wordpress 2 Church Admin, Wordpress 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.
CVE-2026-66472 2 Everestthemes, Wordpress 2 Everest Backup, Wordpress 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.
CVE-2026-28184 2 10web, Wordpress 2 Form Maker By 10web, Wordpress 2026-08-13 8.5 High
Subscriber SQL Injection in Form Maker by 10Web <= 1.15.44 versions.
CVE-2026-59109 2026-08-13 8.8 High
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
CVE-2026-17222 1 Ibm 1 I 2026-08-13 4.3 Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command.
CVE-2026-61966 2 Denishua, Wordpress 2 Wpjam Basic, Wordpress 2026-08-13 9.3 Critical
Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.
CVE-2026-17419 1 Ibm 1 I 2026-08-13 6.5 Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.
CVE-2026-17418 1 Ibm 1 I 2026-08-13 8.5 High
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command.
CVE-2026-73346 2026-08-13 7.6 High
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
CVE-2026-66658 2026-08-13 8.5 High
Subscriber SQL Injection in Reviewer <= 3.14.2 versions.
CVE-2026-66446 2026-08-13 9.3 Critical
Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.
CVE-2026-66436 2 Realmag777, Wordpress 2 Active Products Tables For Woocommerce, Wordpress 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
CVE-2026-66430 2026-08-13 8.5 High
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
CVE-2026-28168 2026-08-13 8.5 High
Subscriber SQL Injection in CubeWP <= 1.1.30 versions.
CVE-2026-28156 2026-08-13 8.5 High
Subscriber SQL Injection in Do Lasso <= 358 versions.
CVE-2026-28142 2 Shamalli, Wordpress 2 Web Directory Free, Wordpress 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
CVE-2026-27538 2 Wordpress, Wpdirectorykit 2 Wordpress, Wp Directory Kit 2026-08-13 7.5 High
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
CVE-2026-15741 1 Postgresql 1 Postgresql 2026-08-13 8.8 High
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-73670 2026-08-13 7.2 High
A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.
CVE-2026-46670 1 Yeswiki 1 Yeswiki 2026-08-13 9.8 Critical
YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.