Export limit exceeded: 21696 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (21696 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78309 | 1 Deltaww | 1 Diaenergie | 2026-10-15 | 8.8 High |
| SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | ||||
| CVE-2026-105856 | 1 Payloadcms | 5 Db-d1-sqlite, Db-postgres, Db-sqlite and 2 more | 2026-10-15 | 8.3 High |
| Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0. | ||||
| CVE-2026-32176 | 1 Microsoft | 18 Microsoft Sql Server 2016 Service Pack 3 (gdr), Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft Sql Server 2017 (cu 31) and 15 more | 2026-10-14 | 6.7 Medium |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-80381 | 1 Ibm | 1 Guardium Data Protection | 2026-10-14 | 9.8 Critical |
| IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. | ||||
| CVE-2026-81932 | 1 Ibm | 1 Guardium Data Protection | 2026-10-14 | 8.6 High |
| IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. | ||||
| CVE-2026-89201 | 1 Siemens | 1 Ruggedcom Crossbow | 2026-10-14 | 7.5 High |
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. | ||||
| CVE-2026-89196 | 1 Siemens | 1 Ruggedcom Crossbow | 2026-10-14 | 8.8 High |
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database. | ||||
| CVE-2026-5048 | 1 Broadcom | 1 Brocade Sannav | 2026-10-14 | 8.0 High |
| In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters. | ||||
| CVE-2022-46908 | 1 Sqlite | 1 Sqlite | 2026-10-14 | 7.3 High |
| SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. | ||||
| CVE-2026-102428 | 2 Ordasoft, Ordasoft.com | 2 Joomla Cck, Ordasoft Joomla Cck | 2026-10-14 | 9.8 Critical |
| Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector. | ||||
| CVE-2026-108814 | 1 Semcms | 1 Semcms | 2026-10-14 | 6.3 Medium |
| A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108806 | 1 Krupalshah | 1 Employeerecruitmentsystem | 2026-10-14 | 7.3 High |
| A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108779 | 2 Erzhongxmu, Jeewms | 2 Jeewms, Jeewms | 2026-10-14 | 6.3 Medium |
| A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108774 | 2 Erzhongxmu, Jeewms | 2 Jeewms, Jeewms | 2026-10-14 | 6.3 Medium |
| A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108100 | 1 Hortusfox | 1 Hortusfox | 2026-10-14 | 6.5 Medium |
| HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which PlantsModel::getSpecificInfo() concatenates into the column list, to read any database table including user password hashes. | ||||
| CVE-2022-29155 | 3 Debian, Netapp, Openldap | 14 Debian Linux, H300s, H300s Firmware and 11 more | 2026-10-14 | 9.8 Critical |
| In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping. | ||||
| CVE-2026-109901 | 2026-10-14 | 8.5 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41. | ||||
| CVE-2026-109620 | 1 Sourcecodester | 1 Online Reviewer System | 2026-10-14 | 7.3 High |
| A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2022-24407 | 6 Cyrusimap, Debian, Fedoraproject and 3 more | 14 Cyrus-sasl, Debian Linux, Fedora and 11 more | 2026-10-14 | 8.8 High |
| In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. | ||||
| CVE-2026-109523 | 1 Girishsaraf | 1 Online-appointment-booking-system | 2026-10-14 | 7.3 High |
| A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. | ||||