Export limit exceeded: 20505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20505 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55509 | 1 Mar10 | 1 Wsgidav | 2026-08-28 | N/A |
| WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5. | ||||
| CVE-2026-77635 | 1 Cakephp | 2 Cakephp, Cakephp/database | 2026-08-28 | N/A |
| CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7. | ||||
| CVE-2026-32555 | 2 Pixelyoursite Professional, Wordpress | 2 Boost, Wordpress | 2026-08-28 | 9.3 Critical |
| Unauthenticated SQL Injection in Boost <= 2.0.4 versions. | ||||
| CVE-2026-77137 | 1 Typo3 | 1 Extension "forms Export" | 2026-08-28 | N/A |
| The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module. | ||||
| CVE-2026-77824 | 2 Wordpress, Wpcreatix | 2 Wordpress, Media Sweep – Wordpress Media Cleaner | 2026-08-28 | 4.9 Medium |
| The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-18884 | 2 Wordpress, Wpgenie | 2 Wordpress, Woocommerce Lottery | 2026-08-28 | 7.5 High |
| The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-80236 | 1 Thinkingsoftware | 1 Efence | 2026-08-28 | 8.2 High |
| Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents. | ||||
| CVE-2026-32479 | 2026-08-28 | 9.3 Critical | ||
| Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. | ||||
| CVE-2026-72750 | 1 N8n | 1 N8n | 2026-08-28 | 8.8 High |
| n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders. | ||||
| CVE-2026-82227 | 2 Villatheme, Wordpress | 2 Wpbulky, Wordpress | 2026-08-28 | 8.5 High |
| Contributor SQL Injection in WPBulky <= 1.2.2 versions. | ||||
| CVE-2026-78614 | 1 Watchguard | 1 Dimension | 2026-08-28 | N/A |
| WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests. | ||||
| CVE-2026-78612 | 1 Watchguard | 1 Dimension | 2026-08-28 | N/A |
| WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests. | ||||
| CVE-2026-81728 | 1 Dolibarr | 3 Dolibarr, Dolibarr Erp\/crm, Erp Crm | 2026-08-28 | 8.1 High |
| Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers, parentheses, spaces and quotes intact. import_insert() in htdocs/core/modules/import/import_csv.modules.php then iterates the submitted values and builds a filter with $where[] = $key.' = '.$data[$key], having first applied preg_replace('/^.*\./i', '', $key), an alias strip that does nothing to a value containing no dot. The assembled string is executed through $this->db->query(). The injected SELECT resolves the row id that the import then assigns to $lastinsertid, which becomes the WHERE target of a subsequent UPDATE, so a UNION SELECT returning an attacker-chosen integer both exfiltrates arbitrary table content and redirects which row the import overwrites; for category link tables the raw filter array is spliced into that UPDATE directly. The interface offers a fixed list of legitimate column codes but the server never checks the submitted values against it. A user holding the import permission can exploit this. Release 23.0.4 does not carry the fix; the allow-list test was added in 24.0.0. | ||||
| CVE-2026-78072 | 1 Jefferson49 | 1 Sexy Polling Reloaded Extension For Joomla | 2026-08-28 | N/A |
| Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1 | ||||
| CVE-2026-32550 | 2 Liquid Web, Llc, Wordpress | 2 Kadence Shop Kit, Wordpress | 2026-08-28 | 8.5 High |
| Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions. | ||||
| CVE-2026-78260 | 2 Epayco, Wordpress | 2 Epayco, Wordpress | 2026-08-28 | 9.3 Critical |
| Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. | ||||
| CVE-2026-81277 | 2 Villatheme, Wordpress | 2 Suggestion Engine For Woocommerce, Wordpress | 2026-08-28 | 8.5 High |
| Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions. | ||||
| CVE-2026-81672 | 1 Toools | 1 Isquad | 2026-08-28 | N/A |
| SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework’s error handler, which increases the severity due to the combination of information disclosure and SQL injection. | ||||
| CVE-2026-81673 | 1 Toools | 1 Isquad | 2026-08-28 | N/A |
| The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records. | ||||
| CVE-2026-81674 | 1 Toools | 1 Isquad | 2026-08-28 | N/A |
| The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation. | ||||