CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2017(SQL Injection)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-1002028 89 Sql 2017-09-14 2017-09-20
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.
2 CVE-2017-1002027 89 Sql 2017-09-14 2017-09-20
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php.
3 CVE-2017-1002026 89 Sql 2017-09-14 2017-09-20
6.5
None Remote Low Single system Partial Partial Partial
Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
4 CVE-2017-1002025 89 Sql 2017-09-14 2017-09-21
6.5
None Remote Low Single system Partial Partial Partial
Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement.
5 CVE-2017-1002023 89 Sql 2017-09-14 2017-09-21
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php
6 CVE-2017-1002022 89 Sql 2017-09-14 2017-09-18
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.
7 CVE-2017-1002021 89 Sql 2017-09-14 2017-09-18
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query.
8 CVE-2017-1002020 89 Sql 2017-09-14 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.
9 CVE-2017-1002019 89 Sql 2017-09-14 2017-09-18
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
10 CVE-2017-1002018 89 Sql 2017-09-14 2017-09-18
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
11 CVE-2017-1002015 89 Sql 2017-09-14 2017-09-20
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter.
12 CVE-2017-1002014 89 Sql 2017-09-14 2017-09-20
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter.
13 CVE-2017-1002013 89 Sql 2017-09-14 2017-09-20
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.
14 CVE-2017-1002010 89 Sql 2017-09-14 2017-09-21
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.
15 CVE-2017-1002009 89 Sql 2017-09-14 2017-09-21
7.5
None Remote Low Not required Partial Partial Partial
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.
16 CVE-2017-1000129 Sql 2017-11-17 2017-11-17
0.0
None ??? ??? ??? ??? ??? ???
Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure
17 CVE-2017-1000120 89 Exec Code Sql 2017-10-04 2017-10-13
6.5
None Remote Low Single system Partial Partial Partial
[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
18 CVE-2017-1000067 89 Sql 2017-07-17 2017-07-21
6.5
None Remote Low Single system Partial Partial Partial
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
19 CVE-2017-1000060 89 Sql 2017-07-17 2017-07-19
10.0
None Remote Low Not required Complete Complete Complete
EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root
20 CVE-2017-1000031 89 Exec Code Sql 2017-07-17 2017-07-19
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.
21 CVE-2017-1000004 89 Exec Code Sql 2017-07-17 2017-08-04
7.5
None Remote Low Not required Partial Partial Partial
ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution.
22 CVE-2017-16896 Sql 2017-11-20 2017-11-20
0.0
None ??? ??? ??? ??? ??? ???
A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.
23 CVE-2017-16851 Sql 2017-11-16 2017-11-16
0.0
None ??? ??? ??? ??? ??? ???
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /MyPage.do widgetid parameter.
24 CVE-2017-16850 Sql 2017-11-16 2017-11-16
0.0
None ??? ??? ??? ??? ??? ???
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action.
25 CVE-2017-16849 Sql 2017-11-16 2017-11-16
0.0
None ??? ??? ??? ??? ??? ???
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter.
26 CVE-2017-16848 Sql 2017-11-16 2017-11-16
0.0
None ??? ??? ??? ??? ??? ???
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter.
27 CVE-2017-16847 Sql 2017-11-16 2017-11-16
0.0
None ??? ??? ??? ??? ??? ???
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action.
28 CVE-2017-16846 Sql 2017-11-16 2017-11-16
0.0
None ??? ??? ??? ??? ??? ???
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter.
29 CVE-2017-16561 Sql 2017-11-07 2017-11-07
0.0
None ??? ??? ??? ??? ??? ???
/view/friend_profile.php in Ingenious School Management System 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'friend_index' parameter of a GET request.
30 CVE-2017-16543 Sql 2017-11-05 2017-11-09
0.0
None ??? ??? ??? ??? ??? ???
Zoho ManageEngine Applications Manager 13 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.
31 CVE-2017-16542 Sql 2017-11-05 2017-11-09
0.0
None ??? ??? ??? ??? ??? ???
Zoho ManageEngine Applications Manager 13 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request.
32 CVE-2017-16510 89 Sql 2017-11-02 2017-11-22
7.5
None Remote Low Not required Partial Partial Partial
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.
33 CVE-2017-16000 89 Exec Code Sql 2017-10-29 2017-11-16
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
34 CVE-2017-15993 89 Sql 2017-10-31 2017-11-17
7.5
None Remote Low Not required Partial Partial Partial
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
35 CVE-2017-15992 89 Sql 2017-10-31 2017-11-17
7.5
None Remote Low Not required Partial Partial Partial
Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
36 CVE-2017-15991 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.
37 CVE-2017-15989 89 Sql 2017-10-31 2017-11-17
7.5
None Remote Low Not required Partial Partial Partial
Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
38 CVE-2017-15988 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.
39 CVE-2017-15987 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
40 CVE-2017-15986 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
CPA Lead Reward Script allows SQL Injection via the username parameter.
41 CVE-2017-15985 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
42 CVE-2017-15984 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.
43 CVE-2017-15983 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
44 CVE-2017-15982 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
45 CVE-2017-15981 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
46 CVE-2017-15980 89 Sql 2017-10-31 2017-11-17
7.5
None Remote Low Not required Partial Partial Partial
US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
47 CVE-2017-15979 89 Sql 2017-10-31 2017-11-18
7.5
None Remote Low Not required Partial Partial Partial
Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.
48 CVE-2017-15978 89 Sql 2017-10-31 2017-11-17
7.5
None Remote Low Not required Partial Partial Partial
AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
49 CVE-2017-15977 89 Sql 2017-10-31 2017-11-17
7.5
None Remote Low Not required Partial Partial Partial
Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
50 CVE-2017-15976 89 Sql 2017-10-29 2017-11-17
7.5
None Remote Low Not required Partial Partial Partial
ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604.
Total number of vulnerabilities : 371   Page : 1 (This Page)2 3 4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.