Total
14689 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-16309 | 1 Flamecms Project | 1 Flamecms | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| FlameCMS 3.3.5 has SQL injection in account/login.php via accountName. | |||||
| CVE-2019-16264 | 1 Egpp | 1 Sistema Integrado De Gestion Academica | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username parameter of the authentication form is vulnerable to SQL injection, allowing attackers to access the database. | |||||
| CVE-2019-16194 | 1 Centreon | 1 Centreon | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php. | |||||
| CVE-2019-16125 | 1 Jobberbase | 1 Jobberbase | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection. | |||||
| CVE-2019-16119 | 1 10web | 1 Photo Gallery | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter. | |||||
| CVE-2019-16065 | 1 Netsas | 1 Enigma Network Management Solution | 2024-11-21 | 9.0 HIGH | 8.8 HIGH |
| A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user. This affects the search_pattern value of the manage_hosts_short.cgi script. | |||||
| CVE-2019-16012 | 1 Cisco | 12 1100-4g Integrated Services Router, 1100-4gltegb Integrated Services Router, 1100-4gltena Integrated Services Router and 9 more | 2024-11-21 | 8.5 HIGH | 8.1 HIGH |
| A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system. | |||||
| CVE-2019-15995 | 1 Cisco | 1 Dna Spaces\ | 2024-11-21 | 5.5 MEDIUM | 6.5 MEDIUM |
| A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicious SQL statements in an affected field in the web UI. A successful exploit could allow the attacker to remove the SQL database, which would require the reinstallation of the Connector VM. | |||||
| CVE-2019-15985 | 1 Cisco | 1 Data Center Network Manager | 2024-11-21 | 9.0 HIGH | 7.2 HIGH |
| Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. | |||||
| CVE-2019-15984 | 1 Cisco | 1 Data Center Network Manager | 2024-11-21 | 9.0 HIGH | 7.2 HIGH |
| Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. | |||||
| CVE-2019-15972 | 1 Cisco | 1 Unified Communications Manager | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database. | |||||
| CVE-2019-15933 | 1 Intesync | 1 Solismed | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Intesync Solismed 3.3sp has SQL Injection. | |||||
| CVE-2019-15872 | 1 Wpbrigade | 1 Loginpress | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings. | |||||
| CVE-2019-15659 | 1 Genetechsolutions | 1 Pie Register | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969. | |||||
| CVE-2019-15658 | 1 Connect-pg-simple Project | 1 Connect-pg-simple | 2024-11-21 | 7.5 HIGH | 7.3 HIGH |
| connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data. | |||||
| CVE-2019-15646 | 1 Carrcommunications | 1 Rsvpmaker | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The rsvpmaker plugin before 6.2 for WordPress has SQL injection. | |||||
| CVE-2019-15622 | 1 Nextcloud | 1 Nextcloud | 2024-11-21 | 2.1 LOW | 2.4 LOW |
| Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries. | |||||
| CVE-2019-15574 | 1 Cipsoft | 1 Gesior-aac | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php. | |||||
| CVE-2019-15573 | 1 Cipsoft | 1 Gesior-aac | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php. | |||||
| CVE-2019-15572 | 1 Cipsoft | 1 Gesior-aac | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php. | |||||