Export limit exceeded: 20327 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20327 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19351 | 1 Dresende | 1 Node-sql-query | 2026-08-13 | 7.3 High |
| A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended. | ||||
| CVE-2026-28001 | 2 Wordpress, Wpdirectorykit | 2 Wordpress, Wp Directory Kit | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | ||||
| CVE-2026-16961 | 1 Ibm | 1 I | 2026-08-13 | 7.6 High |
| IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. | ||||
| CVE-2026-61969 | 2 Webilia Inc., Wordpress | 2 Listdom, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. | ||||
| CVE-2026-28002 | 2 Arraytics, Wordpress | 2 Booktics, Wordpress | 2026-08-13 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22. | ||||
| CVE-2026-66458 | 2 Thimpress, Wordpress | 2 Realpress, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in RealPress <= 1.1.2 versions. | ||||
| CVE-2026-66478 | 2 Andymoyle, Wordpress | 2 Church Admin, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | ||||
| CVE-2026-66472 | 2 Everestthemes, Wordpress | 2 Everest Backup, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | ||||
| CVE-2026-17222 | 1 Ibm | 1 I | 2026-08-13 | 4.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-61966 | 2 Denishua, Wordpress | 2 Wpjam Basic, Wordpress | 2026-08-13 | 9.3 Critical |
| Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. | ||||
| CVE-2026-17418 | 1 Ibm | 1 I | 2026-08-13 | 8.5 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-66436 | 2 Realmag777, Wordpress | 2 Active Products Tables For Woocommerce, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. | ||||
| CVE-2026-28142 | 2 Shamalli, Wordpress | 2 Web Directory Free, Wordpress | 2026-08-13 | 9.3 Critical |
| Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | ||||
| CVE-2026-27538 | 2 Wordpress, Wpdirectorykit | 2 Wordpress, Wp Directory Kit | 2026-08-13 | 7.5 High |
| Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | ||||
| CVE-2026-46670 | 1 Yeswiki | 1 Yeswiki | 2026-08-13 | 9.8 Critical |
| YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue. | ||||
| CVE-2026-11840 | 1 Zohocorp | 2 Manageengine Pam360, Manageengine Password Manager Pro | 2026-08-13 | 8.8 High |
| Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection. | ||||
| CVE-2026-72562 | 1 Pimcore | 1 Admin Classic Bundle | 2026-08-13 | 8.8 High |
| An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents. | ||||
| CVE-2026-73069 | 1 Twenty | 1 Twenty | 2026-08-13 | 9.1 Critical |
| Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0. | ||||
| CVE-2026-16977 | 2 10web, Wordpress | 2 Form Maker By 10web, Wordpress | 2026-08-13 | 8.1 High |
| The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection. | ||||
| CVE-2026-48381 | 1 Adobe | 1 Campaign Classic | 2026-08-13 | 9 Critical |
| Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed. | ||||