CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (SQL Injection)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-1000067 89 Sql 2017-07-17 2017-07-21
6.5
None Remote Low Single system Partial Partial Partial
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
2 CVE-2017-1000060 89 Sql 2017-07-17 2017-07-19
10.0
None Remote Low Not required Complete Complete Complete
EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root
3 CVE-2017-1000031 89 Exec Code Sql 2017-07-17 2017-07-19
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.
4 CVE-2017-1000004 89 Exec Code Sql 2017-07-17 2017-08-04
7.5
None Remote Low Not required Partial Partial Partial
ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution.
5 CVE-2017-12650 89 Sql 2017-08-07 2017-08-15
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header.
6 CVE-2017-12585 89 Sql 2017-08-05 2017-08-14
6.5
None Remote Low Single system Partial Partial Partial
SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.
7 CVE-2017-12567 89 Sql 2017-08-07 2017-08-15
7.5
None Remote Low Not required Partial Partial Partial
SQL injection exists in Quest KACE Asset Management Appliance 6.4.120822 through 7.2, Systems Management Appliance 6.4.120822 through 7.2.101, and K1000 as a Service 7.0 through 7.2.
8 CVE-2017-12199 89 Sql 2017-08-02 2017-08-03
7.5
None Remote Low Not required Partial Partial Partial
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item.
9 CVE-2017-11736 89 Exec Code Sql 2017-07-29 2017-08-02
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via the tags array parameter.
10 CVE-2017-11678 89 Exec Code Sql 2017-07-27 2017-08-03
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter in admin.php.
11 CVE-2017-11631 89 Sql 2017-07-26 2017-07-31
7.5
None Remote Low Not required Partial Partial Partial
dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.
12 CVE-2017-11584 89 Sql 2017-07-23 2017-07-27
7.5
None Remote Low Not required Partial Partial Partial
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php.
13 CVE-2017-11583 89 Sql 2017-07-23 2017-07-27
7.5
None Remote Low Not required Partial Partial Partial
dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php.
14 CVE-2017-11582 89 Sql 2017-07-23 2017-07-27
7.5
None Remote Low Not required Partial Partial Partial
dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php.
15 CVE-2017-11494 89 Exec Code Sql 2017-08-02 2017-08-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a login action.
16 CVE-2017-11475 89 Sql 2017-07-20 2017-07-21
7.5
None Remote Low Not required Partial Partial Partial
GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php.
17 CVE-2017-11474 89 Sql 2017-07-20 2017-07-21
7.5
None Remote Low Not required Partial Partial Partial
GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php.
18 CVE-2017-11471 89 Sql 2017-07-20 2017-07-24
7.5
None Remote Low Not required Partial Partial Partial
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter.
19 CVE-2017-11470 89 Sql 2017-07-20 2017-07-24
7.5
None Remote Low Not required Partial Partial Partial
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via the element parameter.
20 CVE-2017-11445 89 Sql 2017-07-19 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.
21 CVE-2017-11444 89 Sql 2017-07-19 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
22 CVE-2017-11419 89 Sql 2017-07-18 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].
23 CVE-2017-11418 89 Sql 2017-07-18 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].
24 CVE-2017-11417 89 Sql 2017-07-18 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].
25 CVE-2017-11416 89 Sql 2017-07-18 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.
26 CVE-2017-11415 89 Sql 2017-07-18 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].
27 CVE-2017-11414 89 Sql 2017-07-18 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['status'], $_POST['id'], and $_REQUEST['id'].
28 CVE-2017-11413 89 Sql 2017-07-18 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].
29 CVE-2017-11412 89 Sql 2017-07-18 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].
30 CVE-2017-11388 89 Exec Code Sql 2017-08-02 2017-08-05
6.5
None Remote Low Single system Partial Partial Partial
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638.
31 CVE-2017-11386 89 Exec Code Sql 2017-08-02 2017-08-05
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll. Formerly ZDI-CAN-4549.
32 CVE-2017-11385 89 Exec Code Sql 2017-08-02 2017-08-05
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input validation in cmdHandlerStatusMonitor.dll. Formerly ZDI-CAN-4545.
33 CVE-2017-11384 89 Exec Code Sql 2017-08-02 2017-08-07
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandlerLicenseManager.dll. Formerly ZDI-CAN-4561.
34 CVE-2017-11383 89 Exec Code Sql 2017-08-02 2017-08-07
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input validation in cmdHandlerTVCSCommander.dll. Formerly ZDI-CAN-4560.
35 CVE-2017-11354 89 Sql 2017-07-17 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in editing or adding a tag name.
36 CVE-2017-11329 89 Sql 2017-07-17 2017-07-26
7.5
None Remote Low Not required Partial Partial Partial
GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.
37 CVE-2017-11324 89 Sql 2017-07-24 2017-07-28
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Tilde CMS 1.0.1. Due to missing escaping of the backtick character, a SELECT query in class.SystemAction.php is vulnerable to SQL Injection. The vulnerability can be triggered via a POST request to /actionphp/action.input.php with the id parameter.
38 CVE-2017-11200 89 Sql 2017-07-12 2017-07-16
6.5
None Remote Low Single system Partial Partial Partial
SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.
39 CVE-2017-11184 89 Sql 2017-07-28 2017-08-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.
40 CVE-2017-11174 89 Sql 2017-07-12 2017-07-27
7.5
None Remote Low Not required Partial Partial Partial
In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.
41 CVE-2017-10816 89 Exec Code Sql 2017-08-04 2017-08-15
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to execute arbitrary SQL commands via Relay Service Server.
42 CVE-2017-10682 89 Exec Code Sql 2017-06-29 2017-07-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
43 CVE-2017-9848 89 Exec Code Sql 2017-06-24 2017-07-06
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0 could allow remote attackers to execute arbitrary SQL commands via an XML document containing a crafted ArticleIDs element within a GetArticleHitsArray element.
44 CVE-2017-9759 89 Sql 2017-06-19 2017-06-22
6.5
None Remote Low Single system Partial Partial Partial
SQL Injection exists in admin/index.php in Zenbership 1.0.8 via the filters array parameter, exploitable by a privileged account.
45 CVE-2017-9730 89 Exec Code Sql 2017-06-19 2017-06-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the "r" parameter.
46 CVE-2017-9603 89 Exec Code Sql 2017-06-13 2017-08-12
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php.
47 CVE-2017-9463 89 Sql +Info 2017-06-14 2017-06-19
4.0
None Remote Low Single system Partial None None
The application Piwigo is affected by a SQL injection vulnerability in version 2.9.0 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The user_list_backend.php component is affected: values of the iDisplayStart & iDisplayLength parameters are not sanitized; these are used to construct a SQL query and retrieve a list of registered users into the application.
48 CVE-2017-9449 89 Exec Code Sql 2017-06-06 2017-06-12
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible at admin/ajax/auto-modules/views/searchable-page/ or admin/modules_name.
49 CVE-2017-9443 89 Sql 2017-06-05 2017-06-09
6.5
None Remote Low Single system Partial Partial Partial
** DISPUTED ** BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and core\admin\modules\developer\packages\install\process.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files."
50 CVE-2017-9437 89 Sql 2017-06-05 2017-06-13
6.5
None Remote Low Single system Partial Partial Partial
Openbravo Business Suite 3.0 is affected by SQL injection. This vulnerability could allow remote authenticated attackers to inject arbitrary SQL code.
Total number of vulnerabilities : 6612   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.