Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17936 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-3059 1 Schoolbox 1 Schoolbox 2025-05-05 8.6 High
The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL injection it was possible to extract data from the database.
CVE-2022-43350 1 Sanitization Management System Project 1 Sanitization Management System 2025-05-05 7.2 High
Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_inquiry.
CVE-2022-43052 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-05 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete.
CVE-2022-43051 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-05 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_test.
CVE-2022-43049 1 Canteen Management System Project 1 Canteen Management System 2025-05-05 7.2 High
Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php.
CVE-2022-42990 1 Oretnom23 1 Food Ordering Management System 2025-05-05 7.2 High
Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer.
CVE-2018-11528 1 Wuzhicms 1 Wuzhicms 2025-05-05 N/A
WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.
CVE-2020-20122 1 Wuzhicms 1 Wuzhicms 2025-05-05 9.8 Critical
Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.
CVE-2022-27431 1 Wuzhicms 1 Wuzhicms 2025-05-05 9.8 Critical
Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.
CVE-2024-25288 2 Slims, Slims Project 2 Senayan Library Management System, Slims 2025-05-05 4.9 Medium
SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.
CVE-2022-21720 1 Glpi-project 1 Glpi 2025-05-05 4.9 Medium
GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.
CVE-2022-1505 1 Carrcommunications 1 Rsvpmaker 2025-05-05 9.8 Critical
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.6.
CVE-2022-1453 1 Carrcommunications 1 Rsvpmaker 2025-05-05 9.8 Critical
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
CVE-2021-38324 1 Smartypantsplugins 1 Sp Rental Manager 2025-05-05 8.2 High
The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file which allows attackers to retrieve information contained in a site's database, in versions up to and including 1.5.3.
CVE-2023-27167 1 Supremainc 1 Biostar 2 2025-05-05 6.5 Medium
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.
CVE-2022-46908 1 Sqlite 1 Sqlite 2025-05-05 7.3 High
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
CVE-2022-43126 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-05 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/tests/manage_test.php.
CVE-2022-43125 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-05 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/manage_appointment.php.
CVE-2022-43124 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-05 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user.
CVE-2022-43086 1 Codeastro 1 Restaurant Pos System 2025-05-05 4.9 Medium
Restaurant POS System v1.0 was discovered to contain a SQL injection vulnerability via update_customer.php.