Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17601 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-17119 1 Wikidsystems 1 Two Factor Authentication Enterprise Server 2024-11-21 8.8 High
Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter.
CVE-2019-17117 1 Wikidsystems 1 2fa Enterprise Server 2024-11-21 8.8 High
A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL commands via the processPref.jsp key parameter.
CVE-2019-17072 1 Awplife 1 Contact Form Widget 2024-11-21 9.8 Critical
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
CVE-2019-17049 1 Netgear 2 Srx5308, Srx5308 Firmware 2024-11-21 7.5 High
NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account.
CVE-2019-16999 1 Idcos 1 Cloudboot 2024-11-21 9.8 Critical
CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device/getNumByStatus URI.
CVE-2019-16997 1 Metinfo 1 Metinfo 2024-11-21 7.2 High
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.
CVE-2019-16996 1 Metinfo 1 Metinfo 2024-11-21 7.2 High
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
CVE-2019-16980 1 Fusionpbx 1 Fusionpbx 2024-11-21 8.8 High
In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection.
CVE-2019-16917 1 Wikidsystems 1 Two Factor Authentication Enterprise Server 2024-11-21 8.8 High
WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. The uid and domain parameters are used, unsanitized, in a SQL query constructed in the buildSearchWhereClause function.
CVE-2019-16894 1 Inoideas 1 Inoerp 2024-11-21 9.8 Critical
download.php in inoERP 4.15 allows SQL injection through insecure deserialization.
CVE-2019-16745 1 Ebrigade 1 Ebrigade 2024-11-21 8.8 High
eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection.
CVE-2019-16744 1 Ebrigade 1 Ebrigade 2024-11-21 8.8 High
eBrigade before 5.0 has evenements.php cid SQL Injection.
CVE-2019-16743 1 Ebrigade 1 Ebrigade 2024-11-21 8.8 High
eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.
CVE-2019-16696 1 Phpipam 1 Phpipam 2024-11-21 9.8 Critical
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
CVE-2019-16695 1 Phpipam 1 Phpipam 2024-11-21 9.8 Critical
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
CVE-2019-16694 1 Phpipam 1 Phpipam 2024-11-21 9.8 Critical
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.
CVE-2019-16692 1 Phpipam 1 Phpipam 2024-11-21 9.8 Critical
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.
CVE-2019-16682 1 Url Redirect Project 1 Url Redirect 2024-11-21 7.3 High
The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.
CVE-2019-16644 1 Tuzicms 1 Tuzicms 2024-11-21 9.8 Critical
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.
CVE-2019-16642 1 Yejiao 1 Tuzicms 2024-11-21 9.8 Critical
App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring.