CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-89

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-4040 89 Exec Code Sql 2016-04-19 2016-04-22
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
2 CVE-2016-3675 89 Exec Code Sql 2016-04-11 2016-04-13
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to system databases.
3 CVE-2016-3659 89 Exec Code Sql 2016-04-11 2016-04-12
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.
4 CVE-2016-3172 89 Exec Code Sql 2016-04-12 2016-04-12
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.
5 CVE-2016-2386 89 Exec Code Sql 2016-02-16 2016-02-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
6 CVE-2016-2301 89 Exec Code Sql 2016-04-21 2016-04-27
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
7 CVE-2016-2299 89 Exec Code Sql 2016-04-21 2016-04-27
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
8 CVE-2016-1308 89 Exec Code Sql 2016-02-07 2016-02-16
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Cisco Unified Communications Manager 10.5(2.13900.9) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCux99227.
9 CVE-2016-1154 89 Exec Code Sql 2016-02-19 2016-03-02
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
10 CVE-2016-0710 89 Exec Code Sql 2016-04-11 2016-04-20
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
11 CVE-2015-8769 89 Exec Code Sql 2016-01-12 2016-01-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.
12 CVE-2015-8604 89 Exec Code Sql 2016-04-11 2016-04-18
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.
13 CVE-2015-8377 89 Exec Code Sql 2015-12-15 2015-12-16
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action.
14 CVE-2015-8369 89 Exec Code Sql 2015-12-17 2015-12-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.
15 CVE-2015-8261 89 Sql 2016-01-07 2016-01-08
7.5
None Remote Low Not required Partial Partial Partial
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via a crafted SOAP request.
16 CVE-2015-8153 89 Exec Code Sql 2016-03-18 2016-03-21
8.3
None Remote Low Multiple systems Complete Complete Complete
SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
17 CVE-2015-7999 89 Exec Code Sql 2016-04-14 2016-04-19
6.5
User Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
18 CVE-2015-7903 89 Exec Code Sql 2015-10-28 2015-10-28
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
19 CVE-2015-7876 89 Exec Code Sql 2015-10-21 2016-04-05
7.5
None Remote Low Not required Partial Partial Partial
The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function.
20 CVE-2015-7858 89 Exec Code Sql 2015-10-29 2015-10-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7297.
21 CVE-2015-7857 89 Exec Code Sql 2015-10-29 2015-10-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
22 CVE-2015-7791 89 Exec Code Sql 2015-12-29 2015-12-30
6.5
None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) search[column] or (2) switch parameter.
23 CVE-2015-7784 89 Exec Code Sql 2015-12-30 2015-12-30
4.0
None Remote Low Single system None None Partial
SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
24 CVE-2015-7448 89 Exec Code Sql 2016-03-12 2016-03-22
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 IFIX003, and 7.6.0 before 7.6.0.3 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 IFIX003, 7.5.1, and 7.6.0 before 7.6.0.3 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
25 CVE-2015-7387 89 Exec Code Sql Bypass 2015-09-28 2015-10-13
7.5
None Remote Low Not required Partial Partial Partial
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO."
26 CVE-2015-7382 89 Exec Code Sql 2015-09-27 2015-09-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter, a different issue than CVE-2015-6009.
27 CVE-2015-7319 89 Exec Code Sql 2015-09-29 2015-09-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
28 CVE-2015-7299 89 Exec Code Sql 2015-10-21 2015-10-22
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter.
29 CVE-2015-7297 89 Exec Code Sql 2015-10-29 2015-10-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.
30 CVE-2015-7239 89 Exec Code Sql 2015-09-18 2015-09-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
31 CVE-2015-7235 89 Exec Code Sql 2015-09-17 2015-09-21
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
32 CVE-2015-6962 89 Exec Code Sql 2015-09-17 2015-09-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php.
33 CVE-2015-6943 89 Exec Code Sql 2015-09-15 2016-04-05
6.0
None Remote Medium Single system Partial Partial Partial
SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the serendipity[id] parameter to serendipity_admin.php.
34 CVE-2015-6915 89 Exec Code Sql 2015-09-11 2015-09-14
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php.
35 CVE-2015-6911 89 Exec Code Sql 2015-09-11 2015-09-14
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi.
36 CVE-2015-6910 89 Exec Code Sql 2015-09-11 2015-09-14
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi.
37 CVE-2015-6829 89 Exec Code Sql 2015-09-16 2015-09-17
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header.
38 CVE-2015-6811 89 Exec Code Sql 2015-09-04 2015-09-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.xml.
39 CVE-2015-6659 89 Exec Code Sql 2015-08-24 2015-09-24
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
40 CVE-2015-6548 89 Exec Code Sql 2015-09-20 2015-09-21
5.8
None Remote Low Multiple systems Partial Partial Partial
Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
41 CVE-2015-6537 89 Exec Code Sql 2015-12-27 2015-12-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a crafted URL.
42 CVE-2015-6522 89 Exec Code Sql 2015-08-19 2015-08-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.
43 CVE-2015-6519 89 Exec Code Sql 2015-08-18 2015-08-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action to members.php.
44 CVE-2015-6516 89 Exec Code Sql 2015-08-18 2015-08-19
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
45 CVE-2015-6513 89 Exec Code Sql 2015-08-18 2015-08-19
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the J2Store (com_j2store) extension before 3.1.7 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) sortby or (2) manufacturer_ids[] parameter to index.php.
46 CVE-2015-6512 89 Exec Code Sql 2015-08-18 2015-08-19
5.0
None Remote Low Not required Partial None None
SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to execute arbitrary SQL commands via the time parameter to server/freichat.php.
47 CVE-2015-6486 89 Exec Code Sql 2015-10-28 2015-10-28
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
48 CVE-2015-6433 89 Exec Code Sql 2016-01-07 2016-01-08
4.0
None Remote Low Single system None Partial None
SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCut66767.
49 CVE-2015-6350 89 Exec Code Sql 2015-10-30 2015-10-30
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuw50843.
50 CVE-2015-6345 89 Exec Code Sql 2015-10-30 2015-10-30
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuw24700.
Total number of vulnerabilities : 4154   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.