CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Security Vulnerabilities Published In 2013(SQL Injection)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-7242 89 Exec Code Sql 2013-12-31 2016-12-31
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter.
2 CVE-2013-7232 89 Exec Code Sql 2013-12-30 2013-12-31
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.
3 CVE-2013-7216 89 Exec Code Sql 2013-12-24 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Classifieds Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to demo/classifieds/product.asp, or (2) UserID or (3) Password field to demo/classifieds/admin.asp.
4 CVE-2013-7193 89 Exec Code Sql 2013-12-21 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) pa parameter to auction/asp/list.asp, or the (2) UserID or (3) Password to auction/casp/admin.asp.
5 CVE-2013-7192 89 Exec Code Sql 2013-12-21 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Dynamic Biz Website Builder (QuickWeb) allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/news-events/newdetail.asp, or the (2) UserID or (3) Password to login.asp.
6 CVE-2013-7189 89 Exec Code Sql 2013-12-20 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrary SQL commands via the cmbdomain parameter to (1) checktransferstatus.php, (2) checktransferstatusbck.php, or (3) additionalsettings.php; or (4) invno parameter to payinvoiceothers.php.
7 CVE-2013-7187 89 1 Exec Code Sql 2013-12-20 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
8 CVE-2013-7149 89 Exec Code Sql 2013-12-28 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method.
9 CVE-2013-7096 89 Exec Code Sql 2013-12-13 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
10 CVE-2013-7094 89 Exec Code Sql 2013-12-13 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
11 CVE-2013-7092 89 Exec Code Sql 2013-12-13 2017-08-29
6.5
 None Remote Low ??? Partial Partial Partial
Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) events_col, (2) event_id, (3) reason, (4) events_order, (5) emailstatus_order, or (6) emailstatus_col JSON keys.
12 CVE-2013-6985 89 Exec Code Sql 2013-12-09 2013-12-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in m_worklog/log_searchday.jsp in Enorth Webpublisher CMS, possibly 5.0 and earlier, allows remote attackers to execute arbitrary SQL commands via the thisday parameter.
13 CVE-2013-6983 89 Exec Code Sql 2013-12-31 2017-08-29
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuh35615.
14 CVE-2013-6936 89 1 Exec Code Sql 2013-12-04 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL commands via the (1) tooltip or (2) usertooltip parameter.
15 CVE-2013-6929 89 Exec Code Sql 2013-12-28 2013-12-30
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.
16 CVE-2013-6875 89 Exec Code Sql 2013-11-26 2013-11-27
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.
17 CVE-2013-6873 89 Exec Code Sql 2013-11-26 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Testa Online Test Management System (OTMS) 2.0.0.2 allows remote attackers to execute arbitrary SQL commands via the test_id parameter.
18 CVE-2013-6869 89 Exec Code Sql 2013-11-23 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
19 CVE-2013-6839 89 Exec Code Sql 2013-12-13 2013-12-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id].
20 CVE-2013-6787 89 1 Exec Code Sql 2013-12-05 2013-12-27
6.0
 None Remote Medium ??? Partial Partial Partial
SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter.
21 CVE-2013-6341 89 1 Exec Code Sql 2013-12-05 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to index.php.
22 CVE-2013-6243 89 Exec Code Sql 2013-10-23 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the "post" parameter to index.php.
23 CVE-2013-6176 89 Exec Code Sql 2013-11-21 2015-07-22
6.5
 None Remote Low ??? Partial Partial Partial
Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated users to execute arbitrary SQL commands via unspecified input to a (1) xAdmin or (2) xDashboard form.
24 CVE-2013-6172 89 Exec Code Sql 2013-11-05 2014-03-26
7.5
 None Remote Low Not required Partial Partial Partial
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.
25 CVE-2013-6164 89 1 Exec Code Sql 2013-11-14 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrary SQL commands via the objectId parameter.
26 CVE-2013-6058 89 1 Exec Code Sql 2013-11-14 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in appRain CMF 3.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to blog-by-cat/.
27 CVE-2013-6001 89 Exec Code Sql 2013-12-05 2014-01-03
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
28 CVE-2013-5967 89 Exec Code Sql 2013-10-09 2013-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the date_from parameter to (1) radar-iso27001-potential.php, (2) radar-iso27001-A12IS_acquisition-pot.php, (3) radar-iso27001-A11AccessControl-pot.php, (4) radar-iso27001-A10Com_OP_Mgnt-pot.php, or (5) radar-pci-potential.php in RadarReport/.
29 CVE-2013-5957 89 Exec Code Sql 2013-11-27 2021-04-16
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the _value parameter to (1) ajax/jqState or (2) ajax/jqcounty.
30 CVE-2013-5931 89 Exec Code Sql 2013-09-23 2013-10-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in property_listings_detail.php in Real Estate PHP Script allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
31 CVE-2013-5917 89 Exec Code Sql 2013-09-23 2013-09-23
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the comment_post_ID parameter.
32 CVE-2013-5723 89 Exec Code Sql 2013-09-12 2018-12-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0_DELETE_DERIVATION_TABLE."
33 CVE-2013-5697 89 Exec Code Sql 2013-09-30 2013-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in mod_accounting.c in the mod_accounting module 0.5 and earlier for Apache allows remote attackers to execute arbitrary SQL commands via a Host header.
34 CVE-2013-5696 352 Exec Code Sql CSRF 2013-09-23 2013-09-23
6.8
 None Remote Medium Not required Partial Partial Partial
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.
35 CVE-2013-5694 89 1 Exec Code Sql 2013-11-05 2013-11-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute arbitrary SQL commands via the service_selection parameter.
36 CVE-2013-5673 89 1 Exec Code Sql 2013-09-10 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.
37 CVE-2013-5589 89 Exec Code Sql 2013-08-29 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
38 CVE-2013-5569 89 Exec Code Sql 2013-08-23 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Slideshare extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
39 CVE-2013-5525 89 Exec Code Sql 2013-10-10 2017-08-29
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502.
40 CVE-2013-5517 89 Exec Code Sql 2013-10-02 2013-10-17
5.5
 None Remote Low ??? None Partial Partial
SQL injection vulnerability in the web framework in Cisco Unified Communications Domain Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuh96567.
41 CVE-2013-5409 89 Exec Code Sql 2013-12-21 2017-08-29
6.5
 None Remote Low ??? Partial Partial Partial
Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
42 CVE-2013-5354 89 Exec Code Sql 2013-12-09 2014-06-18
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Sharetronix 3.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) fb_user_id or (2) tw_user_id parameter to signup.
43 CVE-2013-5322 89 Exec Code Sql 2013-08-20 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the CoolURI extension before 1.0.30 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
44 CVE-2013-5321 89 1 Exec Code Sql 2013-08-20 2013-08-21
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) sensor parameter in a Query action to forensics/base_qry_main.php; the (2) tcp_flags[] or (3) tcp_port[0][4] parameter to forensics/base_stat_alerts.php; the (4) ip_addr[1][8] or (5) port_type parameter to forensics/base_stat_ports.php; or the (6) sortby or (7) rvalue parameter in a search action to vulnmeter/index.php.
45 CVE-2013-5318 89 1 Exec Code Sql 2013-08-20 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Ginkgo CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the rang parameter to index.php.
46 CVE-2013-5311 89 1 Exec Code Sql 2013-08-19 2013-08-20
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL commands via the "n" parameter to (1) browse_videos.php or (2) members.php. NOTE: the cat parameter is already covered by CVE-2008-4157.
47 CVE-2013-5310 89 Exec Code Sql 2013-08-16 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the DB Integration (wfqbe) extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
48 CVE-2013-5306 89 Exec Code Sql 2013-08-16 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Browser - TYPO3 without PHP (browser) extension before 4.5.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
49 CVE-2013-5304 89 Exec Code Sql 2013-08-16 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
50 CVE-2013-5302 89 Exec Code Sql 2013-08-16 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Total number of vulnerabilities : 155   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.