Vulnerabilities (CVE)

Filtered by CWE-89
Total 19921 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2017-9427 1 Bigtreecms 1 Bigtree Cms 2026-06-17 6.5 MEDIUM 8.8 HIGH
SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a crafted table name at admin/developer/modules/designer/ and the injection is visible at admin/dashboard/vitals-statistics/integrity/check/?external=true.
CVE-2017-9426 1 Facetag Project 1 Facetag 2026-06-17 7.5 HIGH 9.8 CRITICAL
ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action.
CVE-2017-9418 1 Goldplugins 1 Testimonials Plugin Easy Testimonials 2026-06-17 6.5 MEDIUM 8.8 HIGH
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.
CVE-2017-9360 1 Websitebaker 1 Websitebaker 2026-06-17 7.5 HIGH 9.8 CRITICAL
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
CVE-2017-9246 1 Newrelic 1 .net Agent 2026-06-17 7.5 HIGH 9.8 CRITICAL
New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.
CVE-2017-8917 1 Joomla 1 Joomla\! 2026-06-17 7.5 HIGH 9.8 CRITICAL
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2017-8835 1 Peplink 12 1350hw2 Firmware, 2500 Firmware, 380hw6 Firmware and 9 more 2026-06-17 7.5 HIGH 9.8 CRITICAL
SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a session ID can be retrieved from the sessions database.
CVE-2017-8796 1 Accellion 1 File Transfer Appliance 2026-06-17 7.5 HIGH 9.8 CRITICAL
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because mysql_real_escape_string is misused, seos/courier/communication_p2p.php allows SQL injection with the app_id parameter.
CVE-2017-8789 1 Accellion 1 File Transfer Appliance 2026-06-17 7.5 HIGH 9.8 CRITICAL
An issue was discovered on Accellion FTA devices before FTA_9_12_180. A report_error.php?year='payload SQL injection vector exists.
CVE-2017-8377 1 Genixcms 1 Genixcms 2026-06-17 6.5 MEDIUM 8.8 HIGH
GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter.
CVE-2017-8198 1 Huawei 1 Fusionsphere 2026-06-17 6.5 MEDIUM 7.2 HIGH
FusionSphere V100R006C00SPC102(NFV) has an SQL injection vulnerability. An authenticated, remote attacker could craft interface messages carrying malicious SQL statements and send them to a target device. Successful exploit could allow the attacker to launch an SQL injection attack and execute SQL commands.
CVE-2017-8015 1 Emc 1 Appsync 2026-06-17 7.5 HIGH 9.8 CRITICAL
EMC AppSync (all versions prior to 3.5) contains a SQL injection vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVE-2017-8002 1 Emc 1 Data Protection Advisor 2026-06-17 6.5 MEDIUM 8.8 HIGH
EMC Data Protection Advisor prior to 6.4 contains multiple blind SQL injection vulnerabilities. A remote authenticated attacker may potentially exploit these vulnerabilities to gain information about the application by causing execution of arbitrary SQL commands.
CVE-2017-7997 1 Gespage 1 Gespage 2026-06-17 7.5 HIGH 9.8 CRITICAL
Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp.
CVE-2017-7991 1 Exponentcms 1 Exponent Cms 2026-06-17 7.5 HIGH 9.8 CRITICAL
Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
CVE-2017-7973 1 Schneider-electric 1 U.motion Builder 2026-06-17 7.5 HIGH 9.8 CRITICAL
A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can use calls to various paths allowing performance of arbitrary SQL commands against the underlying database.
CVE-2017-7952 1 Infor 1 Enterprise Asset Management 2026-06-17 6.5 MEDIUM 8.8 HIGH
INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter.
CVE-2017-7886 1 Dolibarr 1 Dolibarr Erp\/crm 2026-06-17 7.5 HIGH 9.8 CRITICAL
Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.
CVE-2017-7879 1 Flatcore 1 Flatcore-cms 2026-06-17 5.0 MEDIUM 7.5 HIGH
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.
CVE-2017-7878 1 Flatcore 1 Flatcore-cms 2026-06-17 7.5 HIGH 9.8 CRITICAL
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.