Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17941 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-49334 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.
CVE-2023-49333 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.
CVE-2024-21791 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 4.7 Medium
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability.
CVE-2023-49335 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.
CVE-2023-49332 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.
CVE-2023-49331 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.
CVE-2021-38217 1 Sem-cms 1 Semcms 2025-05-08 9.8 Critical
SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.
CVE-2022-43168 1 Rukovoditel 1 Rukovoditel 2025-05-08 9.8 Critical
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.
CVE-2024-25302 1 Remyandrade 1 Event Student Attendance System 2025-05-08 9.8 Critical
Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter.
CVE-2024-24112 1 Exrick 1 Xmall 2025-05-08 9.8 Critical
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVE-2024-24003 1 Jishenghua 1 Jsherp 2025-05-08 9.8 Critical
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
CVE-2023-33770 2025-05-08 5.1 Medium
Real Estate Management System v1.0 was discovered to contain a SQL injection vulnerability via the message parameter at /contact.php.
CVE-2024-3265 1 Advance Search Project 1 Advance Search 2025-05-08 4.7 Medium
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
CVE-2025-3220 1 Phpgurukul 1 E-diary Management System 2025-05-08 7.3 High
A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-3217 1 Phpgurukul 1 E-diary Management System 2025-05-08 7.3 High
A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /registration.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-3216 1 Phpgurukul 1 E-diary Management System 2025-05-08 7.3 High
A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been classified as critical. This affects an unknown part of the file /password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-3006 1 Phpgurukul 1 E-diary Management System 2025-05-08 7.3 High
A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /edit-category.php?id=8. The manipulation of the argument Category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-2372 1 Phpgurukul 1 Human Metapneumovirus Testing Management System 2025-05-08 7.3 High
A vulnerability classified as critical has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This affects an unknown part of the file /password-recovery.php of the component Password Recovery Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-2373 1 Phpgurukul 1 Human Metapneumovirus Testing Management System 2025-05-08 6.3 Medium
A vulnerability classified as critical was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This vulnerability affects unknown code of the file /check_availability.php. The manipulation of the argument mobnumber/employeeid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-2374 1 Phpgurukul 1 Human Metapneumovirus Testing Management System 2025-05-08 6.3 Medium
A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This issue affects some unknown processing of the file /profile.php. The manipulation of the argument aid/adminname/mobilenumber/email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.