CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2015(SQL Injection)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-8377 89 Exec Code Sql 2015-12-15 2016-12-07
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action.
2 CVE-2015-8369 89 Exec Code Sql 2015-12-17 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php.
3 CVE-2015-7903 89 Exec Code Sql 2015-10-28 2015-10-28
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
4 CVE-2015-7876 89 Exec Code Sql 2015-10-21 2016-06-01
7.5
 None Remote Low Not required Partial Partial Partial
The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function.
5 CVE-2015-7858 89 Exec Code Sql 2015-10-29 2017-09-12
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7297.
6 CVE-2015-7857 89 Exec Code Sql 2015-10-29 2017-09-12
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
7 CVE-2015-7791 89 Exec Code Sql 2015-12-29 2017-07-17
6.5
 None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) search[column] or (2) switch parameter.
8 CVE-2015-7784 89 Exec Code Sql 2015-12-30 2015-12-30
4.0
 None Remote Low Single system None None Partial
SQL injection vulnerability in the BOKUBLOCK (1) BbAdminViewsControl213 plugin before 1.1 and (2) BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
9 CVE-2015-7727 Exec Code Sql 2015-10-15 2015-10-15
0.0
 None ??? ??? ??? ??? ??? ???
Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the (1) trace configuration page or (2) getSqlTraceConfiguration function, aka SAP Security Note 2153898.
10 CVE-2015-7725 Exec Code Sql 2015-10-15 2015-10-15
0.0
 None ??? ??? ??? ??? ??? ???
Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticated users to execute arbitrary SQL commands via the (1) remoteSourceName in the dropCredentials function or unspecified vectors in the (2) setTraceLevelsForXsApps, (3) _modifyUser, or (4) _newUser function, aka SAP Security Notes 2153898 and 2153765.
11 CVE-2015-7682 89 Exec Code Sql 2015-10-16 2018-10-09
6.5
 None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
12 CVE-2015-7387 89 Exec Code Sql Bypass 2015-09-28 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO."
13 CVE-2015-7382 89 Exec Code Sql 2015-09-27 2015-09-28
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter, a different issue than CVE-2015-6009.
14 CVE-2015-7319 89 Exec Code Sql 2015-09-29 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
15 CVE-2015-7299 89 Exec Code Sql 2015-10-21 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter.
16 CVE-2015-7297 89 Exec Code Sql 2015-10-29 2017-09-12
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.
17 CVE-2015-7239 89 Exec Code Sql 2015-09-18 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
18 CVE-2015-7235 89 Exec Code Sql 2015-09-17 2016-12-21
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
19 CVE-2015-6962 89 Exec Code Sql 2015-09-17 2016-12-21
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php.
20 CVE-2015-6943 89 Exec Code Sql 2015-09-15 2016-12-21
6.0
 None Remote Medium Single system Partial Partial Partial
SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the serendipity[id] parameter to serendipity_admin.php.
21 CVE-2015-6915 89 Exec Code Sql 2015-09-11 2015-09-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php.
22 CVE-2015-6911 89 Exec Code Sql 2015-09-11 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi.
23 CVE-2015-6910 89 Exec Code Sql 2015-09-11 2018-10-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi.
24 CVE-2015-6829 89 Exec Code Sql 2015-09-16 2015-09-17
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header.
25 CVE-2015-6811 89 Exec Code Sql 2015-09-04 2015-09-04
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.xml.
26 CVE-2015-6659 89 Exec Code Sql 2015-08-24 2016-12-23
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
27 CVE-2015-6548 89 Exec Code Sql 2015-09-20 2016-12-21
5.8
 None Remote Low Multiple systems Partial Partial Partial
Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
28 CVE-2015-6537 89 Exec Code Sql 2015-12-27 2015-12-28
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a crafted URL.
29 CVE-2015-6522 89 Exec Code Sql 2015-08-19 2016-12-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.
30 CVE-2015-6519 89 Exec Code Sql 2015-08-18 2015-08-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action to members.php.
31 CVE-2015-6516 89 Exec Code Sql 2015-08-18 2018-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.
32 CVE-2015-6513 89 Exec Code Sql 2015-08-18 2015-08-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the J2Store (com_j2store) extension before 3.1.7 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) sortby or (2) manufacturer_ids[] parameter to index.php.
33 CVE-2015-6512 89 Exec Code Sql 2015-08-18 2015-08-19
5.0
 None Remote Low Not required Partial None None
SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to execute arbitrary SQL commands via the time parameter to server/freichat.php.
34 CVE-2015-6486 89 Exec Code Sql 2015-10-28 2015-10-28
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
35 CVE-2015-6350 89 Exec Code Sql 2015-10-30 2016-12-07
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuw50843.
36 CVE-2015-6345 89 Exec Code Sql 2015-10-30 2016-12-07
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.7(0.15) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuw24700.
37 CVE-2015-6331 89 Exec Code Sql 2015-10-12 2016-12-09
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the web framework in Cisco Prime Collaboration Assurance 10.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCus39887.
38 CVE-2015-6329 89 Exec Code Sql 2015-10-12 2016-12-09
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Cisco Prime Collaboration Provisioning 10.6 and 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut64074.
39 CVE-2015-6299 89 Exec Code Sql 2015-09-20 2016-12-29
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.
40 CVE-2015-6009 89 Exec Code Sql 2015-09-27 2017-09-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary SQL commands via (1) the where parameter to rss.php or (2) the sqlQuery parameter to search.php, a different issue than CVE-2015-7382.
41 CVE-2015-6004 89 Exec Code Sql 2015-12-26 2016-12-05
6.5
 None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1) the UniqueID (aka sUniqueID) parameter to WrFreeFormText.asp in the Reports component or (2) the Find Device parameter.
42 CVE-2015-5703 89 Exec Code Sql 2015-09-28 2018-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
43 CVE-2015-5668 89 Exec Code Sql 2015-10-29 2015-10-30
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
44 CVE-2015-5659 89 Exec Code Sql 2015-10-10 2015-10-13
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
45 CVE-2015-5648 89 Exec Code Sql 2015-10-10 2015-10-13
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in list.php in phpRechnung before 1.6.5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
46 CVE-2015-5642 89 Exec Code Sql 2015-10-05 2015-10-07
6.5
 None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
47 CVE-2015-5641 89 Exec Code Sql 2015-10-05 2015-10-06
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
48 CVE-2015-5599 89 Exec Code Sql 2015-08-18 2015-08-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
49 CVE-2015-5504 89 Exec Code Sql 2015-08-18 2016-12-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
50 CVE-2015-5459 89 Exec Code Sql 2015-07-08 2016-12-07
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc.
Total number of vulnerabilities : 218   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.