Export limit exceeded: 403287 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 21113 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (21113 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96822 | 2026-09-30 | 9.3 Critical | ||
| Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions. | ||||
| CVE-2026-96346 | 2026-09-30 | 7.6 High | ||
| Author SQL Injection in WP ERP <= 1.17.9 versions. | ||||
| CVE-2026-96345 | 2026-09-30 | 7.6 High | ||
| Administrator SQL Injection in Estatik <= 4.3.5 versions. | ||||
| CVE-2026-94177 | 2026-09-30 | 8.5 High | ||
| Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions. | ||||
| CVE-2026-94115 | 2026-09-30 | 8.5 High | ||
| Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. | ||||
| CVE-2026-94082 | 2026-09-30 | 7.6 High | ||
| Author SQL Injection in Quiz Cat <= 3.1.1 versions. | ||||
| CVE-2026-93621 | 2026-09-30 | 8.2 High | ||
| Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. | ||||
| CVE-2026-62085 | 2026-09-30 | 7.6 High | ||
| Administrator SQL Injection in WP Activity Log <= 5.6.6 versions. | ||||
| CVE-2026-103117 | 1 Os4ed | 1 Opensis-classic | 2026-09-30 | 4.7 Medium |
| A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-102912 | 1 Sourcecodester | 1 Online Leave Management System | 2026-09-30 | 4.7 Medium |
| A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date_start/date_end leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. | ||||
| CVE-2026-102909 | 1 Sourcecodester | 1 Online Reviewer Management System | 2026-09-30 | 7.3 High |
| A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-101108 | 1 Ordasoft.com | 1 Vehicle Manager (free) Extension For Joomla | 2026-09-30 | N/A |
| Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect. | ||||
| CVE-2026-100752 | 1 Ordasoft.com | 1 Real Estate Manager (free) Extension For Joomla | 2026-09-30 | N/A |
| Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast. | ||||
| CVE-2026-62097 | 2026-09-30 | 7.6 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27. | ||||
| CVE-2026-103116 | 1 Os4ed | 1 Opensis-classic | 2026-09-30 | 6.3 Medium |
| A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-103114 | 1 Os4ed | 1 Opensis-classic | 2026-09-30 | 6.3 Medium |
| A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-54812 | 2 Stylemix, Wordpress | 2 Motors, Wordpress | 2026-09-30 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109. | ||||
| CVE-2026-50747 | 2 Ubiquiti, Ui | 2 Unifi Talk Application, Unifi Talk Application | 2026-09-30 | 9.9 Critical |
| A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device. | ||||
| CVE-2026-100315 | 1 Mathurvishal | 1 Cloudclassroom-php-project | 2026-09-30 | 7.3 High |
| A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-100312 | 1 Mathurvishal | 1 Cloudclassroom-php-project | 2026-09-30 | 6.3 Medium |
| A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. | ||||