Total
15951 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-43192 | 1 Jrecms | 1 Springbootcms | 2024-11-21 | N/A | 8.8 HIGH |
| SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statement. | |||||
| CVE-2023-43144 | 1 Projectworlds | 1 Asset Management System Project In Php | 2024-11-21 | N/A | 9.8 CRITICAL |
| Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php. | |||||
| CVE-2023-43132 | 1 Szvone | 1 Vmqphp | 2024-11-21 | N/A | 6.5 MEDIUM |
| szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the administrator password. | |||||
| CVE-2023-43014 | 1 Projectworlds | 1 Asset Management System | 2024-11-21 | N/A | 8.8 HIGH |
| Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'first_name' and 'last_name' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents. | |||||
| CVE-2023-43013 | 1 Projectworlds | 1 Asset Management System | 2024-11-21 | N/A | 9.8 CRITICAL |
| Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control. | |||||
| CVE-2023-42807 | 1 Frappe | 1 Frappe Lms | 2024-11-21 | N/A | 6.3 MEDIUM |
| Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the `main` branch. Users won't face this issue if they are using the latest main branch of the app. | |||||
| CVE-2023-42660 | 1 Progress | 1 Moveit Transfer | 2024-11-21 | N/A | 8.8 HIGH |
| In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content. | |||||
| CVE-2023-42461 | 1 Glpi-project | 1 Glpi | 2024-11-21 | N/A | 6.5 MEDIUM |
| GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. | |||||
| CVE-2023-42406 | 1 Dlink | 2 Dar-7000, Dar-7000 Firmware | 2024-11-21 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component. | |||||
| CVE-2023-42405 | 1 Fit2cloud | 1 Rackshift | 2024-11-21 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list(). | |||||
| CVE-2023-42359 | 1 Exam Form Submission In Php With Source Code Project | 1 Exam Form Submission In Php With Source Code | 2024-11-21 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php. | |||||
| CVE-2023-42284 | 1 Tyk | 1 Tyk | 2024-11-21 | N/A | 9.8 CRITICAL |
| Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query. | |||||
| CVE-2023-42283 | 1 Tyk | 1 Tyk | 2024-11-21 | N/A | 9.8 CRITICAL |
| Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query. | |||||
| CVE-2023-42279 | 1 Iteachyou | 1 Dreamer Cms | 2024-11-21 | N/A | 9.8 CRITICAL |
| Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form. | |||||
| CVE-2023-42268 | 1 Jeecg | 1 Jeecg Boot | 2024-11-21 | N/A | 9.8 CRITICAL |
| Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show. | |||||
| CVE-2023-42178 | 1 Lenosp | 1 Lenosp | 2024-11-21 | N/A | 6.5 MEDIUM |
| Lenosp 1.0.0-1.2.0 is vulnerable to SQL Injection via the log query module. | |||||
| CVE-2023-41891 | 1 Flyte | 1 Flyteadmin | 2024-11-21 | N/A | 3.5 LOW |
| FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue. | |||||
| CVE-2023-41887 | 1 Openrefine | 1 Openrefine | 2024-11-21 | N/A | 9.8 CRITICAL |
| OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue. | |||||
| CVE-2023-41886 | 1 Openrefine | 1 Openrefine | 2024-11-21 | N/A | 7.5 HIGH |
| OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue. | |||||
| CVE-2023-41685 | 1 Ilghera | 1 Woocommerce Support System | 2024-11-21 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System allows SQL Injection.This issue affects Woocommerce Support System: from n/a through 1.2.1. | |||||