CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Security Vulnerabilities Published In 2011(SQL Injection)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2011-5039 89 1 Exec Code Sql 2011-12-30 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to login.php, (3) the filter parameter to widget.dokumenti_lista.php, and (4) the fin_nalog_id parameter to nalozi_naslov.php.
2 CVE-2011-5038 89 Exec Code Sql 2011-12-30 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in hitCode hitAppoint 4.5.17 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
3 CVE-2011-5031 89 1 Exec Code Sql 2011-12-29 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in servlet/capexweb.parentvalidatepassword in cApexWEB 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) dfuserid and (2) dfpassword parameters. NOTE: some of these details are obtained from third party information.
4 CVE-2011-5022 89 Exec Code Sql 2011-12-29 2011-12-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in search.php in Pligg CMS 1.1.2 allows remote attackers to execute arbitrary SQL commands via the status parameter.
5 CVE-2011-4847 89 Exec Code Sql 2011-12-16 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to [email protected]/.
6 CVE-2011-4833 89 Exec Code Sql 2011-12-15 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php.
7 CVE-2011-4829 89 1 Exec Code Sql 2011-12-15 2011-12-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the com_listing component in Barter Sites component 1.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter to index.php.
8 CVE-2011-4826 89 Exec Code Sql 2011-12-15 2012-02-09
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in session.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to process.php. NOTE: some of these details are obtained from third party information.
9 CVE-2011-4824 89 Exec Code Sql 2011-12-15 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.
10 CVE-2011-4823 89 1 Exec Code Sql 2011-12-15 2012-02-09
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Vik Real Estate (com_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) contract parameter in a results action and (2) imm parameter in a show action to index.php.
11 CVE-2011-4811 89 1 Exec Code Sql 2011-12-14 2012-02-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in pokaz_podkat.php in BestShopPro allows remote attackers to execute arbitrary SQL commands via the str parameter.
12 CVE-2011-4808 89 1 Exec Code Sql 2011-12-14 2012-02-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a fnd_home action to index.php.
13 CVE-2011-4803 89 1 Exec Code Sql 2011-12-14 2012-03-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
14 CVE-2011-4802 89 Exec Code Sql 2011-12-14 2023-02-02
6.5
 None Remote Low ??? Partial Partial Partial
Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.
15 CVE-2011-4801 89 1 Exec Code Sql 2011-12-14 2013-08-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in akeyActivationLogin.do in Authenex Web Management Control in Authenex Strong Authentication System (ASAS) Server 3.1.0.2 and 3.1.0.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.
16 CVE-2011-4763 89 Exec Code Sql 2011-12-16 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other files.
17 CVE-2011-4753 89 Exec Code Sql 2011-12-16 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files.
18 CVE-2011-4734 89 Exec Code Sql 2011-12-16 2019-04-22
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by file-manager/ and certain other files.
19 CVE-2011-4725 89 Exec Code Sql 2011-12-16 2019-04-22
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by login_up.php3 and certain other files.
20 CVE-2011-4710 89 1 Exec Code Sql 2011-12-08 2021-03-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Pixie CMS 1.01 through 1.04 allow remote attackers to execute arbitrary SQL commands via the (1) pixie_user parameter and (2) Referer HTTP header in a request to the default URI.
21 CVE-2011-4674 89 1 Exec Code Sql 2011-12-02 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.
22 CVE-2011-4673 89 1 Exec Code Sql 2011-12-02 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
23 CVE-2011-4672 89 1 Exec Code Sql 2011-12-02 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Valid tiny-erp 1.6 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to (1) _partner_list.php, (2) proioncategory_list.php, (3) _rantevou_list.php, (4) syncategory_list.php, (5) synallasomenos_list.php, (6) ypelaton_list.php, and (7) yproion_list.php.
24 CVE-2011-4671 89 1 Exec Code Sql 2011-12-02 2011-12-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).
25 CVE-2011-4669 89 Exec Code Sql 2011-12-02 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.
26 CVE-2011-4646 94 Exec Code Sql 2011-11-30 2011-12-01
6.0
 None Remote Medium ??? Partial Partial Partial
SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information.
27 CVE-2011-4571 89 1 Exec Code Sql 2011-11-29 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Estate Agent (com_estateagent) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showEO action to index.php.
28 CVE-2011-4570 89 1 Exec Code Sql 2011-11-29 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Time Returns (com_timereturns) component 2.0 and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a timereturns action to index.php.
29 CVE-2011-4569 89 1 Exec Code Sql 2011-11-29 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the image2 parameter.
30 CVE-2011-4559 89 Exec Code Sql 2011-11-28 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php.
31 CVE-2011-4542 89 Exec Code Sql 2011-11-30 2018-01-06
7.5
 None Remote Low Not required Partial Partial Partial
Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI.
32 CVE-2011-4349 89 Exec Code Sql 2011-12-10 2011-12-12
4.6
 None Local Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
33 CVE-2011-4215 89 Exec Code Sql 2011-11-01 2012-01-27
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in lib/ooz_access.php in OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the cookieName variable.
34 CVE-2011-4066 89 1 Exec Code Sql 2011-11-04 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
35 CVE-2011-4026 89 1 Exec Code Sql 2011-10-21 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in thanks.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
36 CVE-2011-3989 89 Exec Code Sql 2011-11-04 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in DBD::mysqlPP 0.04 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
37 CVE-2011-3988 89 Exec Code Sql 2011-10-21 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in data/class/SC_Query.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
38 CVE-2011-3838 89 Exec Code Sql 2011-12-24 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to fp.php, (2) epage parameter to newpage.php, (3) epost parameter to newpost.php, and (4) username parameter to login.php in admin/; or the (5) username parameter to mobile/login.php.
39 CVE-2011-3836 352 Sql XSS CSRF 2011-12-24 2017-08-29
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Wuzly 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator, (2) perform cross-site scripting (XSS), (3) perform SQL injection, or have other unspecified impact via unknown vectors.
40 CVE-2011-3688 89 Exec Code Sql 2011-09-27 2012-02-14
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Sonexis ConferenceManager 9.3.14.0 allow remote attackers to execute arbitrary SQL commands via (1) the g parameter to Conference/Audio/AudioResourceContainer.asp or (2) the txtConferenceID parameter to Login/HostLogin.asp.
41 CVE-2011-3615 89 Exec Code Sql 2011-10-24 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third party information.
42 CVE-2011-3394 89 Exec Code Sql 2011-09-15 2012-02-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in findagent.php in MYRE Real Estate Software allows remote attackers to execute arbitrary SQL commands via the page parameter.
43 CVE-2011-3340 89 Exec Code Sql 2011-10-21 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ATCOM Netvolution 2.5.8 ASP allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
44 CVE-2011-3130 89 Sql 2011-08-10 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.
45 CVE-2011-2930 89 Exec Code Sql 2011-08-29 2019-08-08
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
46 CVE-2011-2917 89 1 Exec Code Sql 2011-12-08 2011-12-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter.
47 CVE-2011-2751 89 Exec Code Sql 2011-07-17 2011-07-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Parodia before 6.809 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
48 CVE-2011-2703 89 Exec Code Sql 2011-08-01 2021-06-07
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.
49 CVE-2011-2688 89 Exec Code Sql 2011-07-28 2020-11-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
50 CVE-2011-2546 89 Exec Code Sql 2011-07-28 2017-08-29
5.0
 None Remote Low Not required Partial None None
SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669.
Total number of vulnerabilities : 294   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.