CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2021(SQL Injection)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-45814 89 Sql Bypass 2021-12-28 2022-01-07
7.5
 None Remote Low Not required Partial Partial Partial
Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel with an administrative account.
2 CVE-2021-45255 89 Sql 2021-12-21 2022-01-04
10.0
 None Remote Low Not required Complete Complete Complete
The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.
3 CVE-2021-45253 89 Sql 2021-12-21 2021-12-27
7.5
 None Remote Low Not required Partial Partial Partial
The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.
4 CVE-2021-45252 89 Sql 2021-12-21 2021-12-27
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_topic.php, manage_user.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability.
5 CVE-2021-45041 89 Sql 2021-12-19 2022-01-04
6.5
 None Remote Low ??? Partial Partial Partial
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_date.
6 CVE-2021-45014 89 Sql 2021-12-14 2021-12-15
7.5
 None Remote Low Not required Partial Partial Partial
There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26
7 CVE-2021-44966 89 Sql Bypass 2021-12-13 2021-12-17
10.0
 None Remote Low Not required Complete Complete Complete
SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system.
8 CVE-2021-44874 89 Sql 2021-12-21 2021-12-27
6.5
 None Remote Low ??? Partial Partial Partial
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. The bi report module exposes direct SQL commands via POST data in order to select data for report generation. A malicious actor can use the bi report endpoint as a direct SQL prompt under the authenticated user.
9 CVE-2021-44655 89 Sql Bypass 2021-12-15 2022-03-29
7.5
 None Remote Low Not required Partial Partial Partial
Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to get admin access on the application.
10 CVE-2021-44653 89 Sql Bypass 2021-12-15 2022-03-29
7.5
 None Remote Low Not required Partial Partial Partial
Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to gain access as admin to the application.
11 CVE-2021-44600 89 Sql 2021-12-23 2022-01-04
5.0
 None Remote Low Not required Partial None None
The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password parameter. The predictive tests of this application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve all authentication and information about the users of this system.
12 CVE-2021-44599 89 Sql 2021-12-23 2022-01-04
5.0
 None Remote Low Not required Partial None None
The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system.
13 CVE-2021-44427 89 Sql 2021-11-29 2021-11-30
7.5
 None Remote Low Not required Partial Partial Partial
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
14 CVE-2021-44350 89 Sql 2021-12-15 2021-12-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
15 CVE-2021-44349 89 Sql 2021-12-03 2021-12-06
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php.
16 CVE-2021-44348 89 Sql 2021-12-03 2021-12-06
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php.
17 CVE-2021-44347 89 Sql 2021-12-03 2021-12-06
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php.
18 CVE-2021-44280 89 Sql 2021-12-01 2021-12-22
7.5
 None Remote Low Not required Partial Partial Partial
attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the makeSafe function.
19 CVE-2021-44161 89 Sql 2021-12-29 2022-01-10
5.8
 None Local Network Low Not required Partial Partial Partial
Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication.
20 CVE-2021-44050 89 Sql 2021-12-02 2021-12-06
4.0
 None Remote Low ??? Partial None None
CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that could potentially allow an authenticated user to access sensitive data.
21 CVE-2021-44026 89 Sql 2021-11-19 2021-12-16
7.5
 None Remote Low Not required Partial Partial Partial
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
22 CVE-2021-43851 89 Sql 2021-12-22 2021-12-28
6.5
 None Remote Low ??? Partial Partial Partial
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is posted along when navigating between organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an entity such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607. An upgrade is highly recommended. If an upgrade is not practical, introduce ttValidStatus function as in the latest version and start using it user input check blocks wherever status field is used. For groups.php fix, introduce ttValidInteger function as in the latest version and use it in the access check block in the file.
23 CVE-2021-43830 89 Sql 2021-12-14 2021-12-20
6.5
 None Remote Low ??? Partial Partial Partial
OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the `reassign_to_id` parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch
24 CVE-2021-43822 89 Sql 2021-12-13 2021-12-17
6.8
 None Remote Medium Not required Partial Partial Partial
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
25 CVE-2021-43806 89 Sql 2021-12-15 2021-12-21
6.5
 None Remote Low ??? Partial Partial Partial
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6.
26 CVE-2021-43789 89 Sql 2021-12-07 2021-12-08
7.5
 None Remote Low Not required Partial Partial Partial
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.
27 CVE-2021-43679 89 Sql 2021-12-02 2021-12-03
7.5
 None Remote Low Not required Partial Partial Partial
ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.
28 CVE-2021-43631 89 Sql 2021-12-22 2021-12-28
7.5
 None Remote Low Not required Partial Partial Partial
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php.
29 CVE-2021-43630 89 Exec Code Sql 2021-12-22 2021-12-28
6.5
 None Remote Low ??? Partial Partial Partial
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result, an authenticated malicious user can compromise the databases system and in some cases leverage this vulnerability to get remote code execution on the remote web server.
30 CVE-2021-43629 89 Sql 2021-12-22 2021-12-28
7.5
 None Remote Low Not required Partial Partial Partial
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.
31 CVE-2021-43628 89 Sql 2021-12-22 2021-12-28
7.5
 None Remote Low Not required Partial Partial Partial
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php.
32 CVE-2021-43608 89 Sql 2021-12-09 2021-12-15
7.5
 None Remote Low Not required Partial Partial Partial
Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.
33 CVE-2021-43451 89 Sql 2021-12-01 2021-12-22
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php.
34 CVE-2021-43408 89 Exec Code Sql 2021-11-19 2021-11-24
9.0
 None Remote Low ??? Complete Complete Complete
The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In many cases it also possible to exploit features of SQL server to execute system commands and/or access the local file system. This particular vulnerability can be exploited by any authenticated user who has been granted access to use the Duplicate Post plugin. By default, this is limited to Administrators, however the plugin presents the option to permit access to the Editor, Author, Contributor and Subscriber roles.
35 CVE-2021-43362 89 Sql 2021-11-16 2021-11-17
7.5
 None Remote Low Not required Partial Partial Partial
Due to improper sanitization MedData HBYS software suffers from a remote SQL injection vulnerability. An unauthenticated attacker with the web access is able to extract critical information from the system.
36 CVE-2021-43361 89 Sql 2021-11-16 2021-11-17
7.5
 None Remote Low Not required Partial Partial Partial
Due to improper sanitization MedData HBYS software suffers from a remote SQL injection vulnerability. An unauthenticated attacker with the web access is able to extract critical information from the system.
37 CVE-2021-43338 89 Sql 2021-11-03 2021-11-05
6.5
 None Remote Low ??? Partial Partial Partial
In Ericsson Network Location MPS GMPC21, it is possible to creates a new admin user with a SQL Query for file_name in the export functionality.
38 CVE-2021-43157 89 Sql 2021-12-22 2021-12-28
7.5
 None Remote Low Not required Partial Partial Partial
Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php.
39 CVE-2021-43155 89 Sql 2021-12-22 2021-12-28
7.5
 None Remote Low Not required Partial Partial Partial
Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php.
40 CVE-2021-43140 89 Sql 2021-11-03 2021-11-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
41 CVE-2021-43130 89 Sql 2021-11-03 2021-11-17
10.0
 None Remote Low Not required Complete Complete Complete
An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in customer/login.php.
42 CVE-2021-43035 89 Exec Code Sql 2021-12-06 2021-12-06
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full access to the postgres user account.
43 CVE-2021-42945 89 Sql 2021-12-15 2021-12-15
7.5
 None Remote Low Not required Partial Partial Partial
A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.
44 CVE-2021-42760 89 Sql 2021-12-08 2021-12-09
7.5
 None Remote Low Not required Partial Partial Partial
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests.
45 CVE-2021-42670 89 Exec Code Sql 2021-11-05 2021-11-17
7.5
 None Remote Low Not required Partial Partial Partial
A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
46 CVE-2021-42668 89 Exec Code Sql 2021-11-05 2021-12-16
7.5
 None Remote Low Not required Partial Partial Partial
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server.
47 CVE-2021-42667 89 Exec Code Sql 2021-11-05 2021-11-28
7.5
 None Remote Low Not required Partial Partial Partial
A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some cases he can use this vulnerability in order to get a remote code execution on the remote web server.
48 CVE-2021-42666 89 Exec Code Sql 2021-11-05 2021-11-30
6.5
 None Remote Low ??? Partial Partial Partial
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
49 CVE-2021-42665 89 Sql Bypass 2021-11-05 2021-11-23
7.5
 None Remote Low Not required Partial Partial Partial
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.
50 CVE-2021-42663 74 Sql 2021-11-05 2021-11-09
4.3
 None Remote Medium Not required Partial None None
An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a given link he will display the content of the HTML code of the attacker's choice.
Total number of vulnerabilities : 737   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.