CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (SQL Injection)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
6301 CVE-2019-9759 89 Sql 2019-04-02 2019-04-02
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in TONGDA Office Anywhere 10.18.190121. There is a SQL Injection vulnerability via the general/approve_center/list/input_form/work_handle.php run_id parameter.
6302 CVE-2019-9762 89 Sql 2019-03-14 2019-03-14
7.5
None Remote Low Not required Partial Partial Partial
A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.
6303 CVE-2019-9885 89 Exec Code Sql 2019-07-25 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.
6304 CVE-2019-10123 89 Exec Code Sql 2019-05-31 2019-06-03
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user.
6305 CVE-2019-10232 89 Sql 2019-03-27 2019-03-28
7.5
None Remote Low Not required Partial Partial Partial
Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.
6306 CVE-2019-10262 89 Sql 2019-03-28 2019-03-29
7.5
None Remote Low Not required Partial Partial Partial
A SQL Injection issue was discovered in BlueCMS 1.6. The variable $ad_id is spliced directly in uploads/admin/ad.php in the admin folder, and is not wrapped in single quotes, resulting in injection around the escape of magic quotes.
6307 CVE-2019-10653 89 Sql 2019-07-10 2019-07-11
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Hsycms V1.1. There is a SQL injection vulnerability via a /news/*.html page.
6308 CVE-2019-10664 89 Sql 2019-03-31 2019-05-03
7.5
None Remote Low Not required Partial Partial Partial
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
6309 CVE-2019-10665 74 DoS Sql 2019-09-09 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
6310 CVE-2019-10687 89 Sql 2019-08-21 2019-08-27
7.5
None Remote Low Not required Partial Partial Partial
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
6311 CVE-2019-10692 89 Sql 2019-04-02 2022-05-03
7.5
None Remote Low Not required Partial Partial Partial
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
6312 CVE-2019-10707 89 Sql 2019-04-02 2019-04-03
7.5
None Remote Low Not required Partial Partial Partial
MKCMS V5.0 has SQL injection via the bplay.php play parameter.
6313 CVE-2019-10708 89 Sql 2019-04-02 2019-04-03
7.5
None Remote Low Not required Partial Partial Partial
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
6314 CVE-2019-10748 89 Sql 2019-10-29 2019-10-31
7.5
None Remote Low Not required Partial Partial Partial
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
6315 CVE-2019-10749 89 Sql 2019-10-29 2019-10-31
7.5
None Remote Low Not required Partial Partial Partial
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
6316 CVE-2019-10752 89 Sql 2019-10-17 2019-10-21
7.5
None Remote Low Not required Partial Partial Partial
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
6317 CVE-2019-10757 89 Sql 2019-10-08 2019-10-15
7.5
None Remote Low Not required Partial Partial Partial
knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
6318 CVE-2019-10762 89 Sql 2019-10-30 2019-11-01
7.5
None Remote Low Not required Partial Partial Partial
columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
6319 CVE-2019-10766 89 Sql 2019-11-19 2019-11-20
7.5
None Remote Low Not required Partial Partial Partial
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
6320 CVE-2019-10866 89 Sql 2019-05-23 2019-08-03
7.5
None Remote Low Not required Partial Partial Partial
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
6321 CVE-2019-10910 89 Exec Code Sql 2019-05-16 2021-09-29
7.5
None Remote Low Not required Partial Partial Partial
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
6322 CVE-2019-10913 79 Sql XSS 2019-05-16 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
6323 CVE-2019-11362 89 Sql 2019-04-20 2019-04-22
7.5
None Remote Low Not required Partial Partial Partial
app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.
6324 CVE-2019-11450 89 Sql 2019-04-22 2019-04-22
7.5
None Remote Low Not required Partial Partial Partial
whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.
6325 CVE-2019-11512 89 Sql 2019-07-09 2019-07-10
7.5
None Remote Low Not required Partial Partial Partial
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
6326 CVE-2019-11678 89 Sql 2019-05-02 2019-05-03
7.5
None Remote Low Not required Partial Partial Partial
The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection.
6327 CVE-2019-11768 89 Sql 2019-06-05 2019-06-14
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.
6328 CVE-2019-11821 89 Exec Code Sql 2019-06-30 2019-10-09
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.
6329 CVE-2019-12149 89 Exec Code Sql 2019-06-11 2019-06-12
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands.
6330 CVE-2019-12193 89 Sql 2019-07-19 2019-07-29
7.5
None Remote Low Not required Partial Partial Partial
H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter.
6331 CVE-2019-12196 89 Exec Code Sql 2019-06-05 2019-06-07
7.5
None Remote Low Not required Partial Partial Partial
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter.
6332 CVE-2019-12279 89 Sql 2019-05-22 2019-08-09
7.5
None Remote Low Not required Partial Partial Partial
** DISPUTED ** Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck.
6333 CVE-2019-12348 89 Sql 2021-05-24 2021-05-27
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.
6334 CVE-2019-12349 89 Sql 2022-06-02 2022-06-09
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter.
6335 CVE-2019-12350 89 Sql 2022-06-02 2022-06-09
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma.
6336 CVE-2019-12351 89 Sql 2022-06-02 2022-06-09
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma.
6337 CVE-2019-12598 89 Sql 2019-06-07 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3).
6338 CVE-2019-12599 89 Sql 2019-06-07 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection.
6339 CVE-2019-12600 89 Sql 2019-06-07 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3).
6340 CVE-2019-12601 89 Sql 2019-06-07 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3).
6341 CVE-2019-12723 89 Sql 2019-07-10 2019-07-11
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.
6342 CVE-2019-12838 89 Sql 2019-07-11 2022-04-06
7.5
None Remote Low Not required Partial Partial Partial
SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection.
6343 CVE-2019-12850 89 Sql 2019-07-03 2019-07-10
7.5
None Remote Low Not required Partial Partial Partial
A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
6344 CVE-2019-12918 89 Sql 2019-11-06 2019-11-07
7.5
None Remote Low Not required Partial Partial Partial
Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir].
6345 CVE-2019-12939 89 Sql 2019-06-24 2019-06-26
7.5
None Remote Low Not required Partial Partial Partial
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
6346 CVE-2019-12960 89 Sql 2019-06-25 2019-06-25
7.5
None Remote Low Not required Partial Partial Partial
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_dt_s_d.
6347 CVE-2019-12989 89 Sql 2019-07-16 2019-11-20
7.5
None Remote Low Not required Partial Partial Partial
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
6348 CVE-2019-13026 89 Sql 2019-07-30 2019-08-07
7.5
None Remote Low Not required Partial Partial Partial
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary.
6349 CVE-2019-13027 89 Sql 2019-07-12 2019-07-15
7.5
None Remote Low Not required Partial Partial Partial
Realization Concerto Critical Chain Planner (aka CCPM) 5.10.8071 has SQL Injection in at least in the taskupdt/taskdetails.aspx webpage via the projectname parameter.
6350 CVE-2019-13086 89 Sql CSRF 2019-06-30 2019-07-03
7.5
None Remote Low Not required Partial Partial Partial
core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter.
Total number of vulnerabilities : 6356   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 (This Page)128
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.