Export limit exceeded: 46848 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46848 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-27250 | 1 Online Book Store Project Project | 1 Online Book Store Project | 2025-02-26 | 9.8 Critical |
| Online Book Store Project v1.0 is vulnerable to SQL Injection via /bookstore/bookPerPub.php. | ||||
| CVE-2023-21002 | 1 Google | 1 Android | 2025-02-26 | 7.8 High |
| In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-261193935 | ||||
| CVE-2023-0940 | 1 Metagauss | 1 Profilegrid | 2025-02-26 | 8.8 High |
| The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones. | ||||
| CVE-2022-4148 | 1 Dash10 | 1 Oauth Server | 2025-02-26 | 4.3 Medium |
| The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client. | ||||
| CVE-2022-45636 | 1 Megafeis | 1 Bofei Dbd\+ | 2025-02-26 | 8.1 High |
| An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API requests. | ||||
| CVE-2023-1474 | 1 Automatic Question Paper Generator System Project | 1 Automatic Question Paper Generator System | 2025-02-26 | 6.3 Medium |
| A vulnerability classified as critical was found in SourceCodester Automatic Question Paper Generator System 1.0. This vulnerability affects unknown code of the file users/question_papers/manage_question_paper.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223336. | ||||
| CVE-2023-1542 | 1 Answer | 1 Answer | 2025-02-26 | 5.4 Medium |
| Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6. | ||||
| CVE-2023-1545 | 1 Teampass | 1 Teampass | 2025-02-26 | 7.5 High |
| SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23. | ||||
| CVE-2023-27570 | 1 Prestashop | 1 Eo Tags | 2025-02-26 | 9.8 Critical |
| The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie. | ||||
| CVE-2023-1466 | 1 Oretnom23 | 1 Student Study Center Desk Management System | 2025-02-26 | 6.3 Medium |
| A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(SLEEP(5)))FWlC) AND 'butz'='butz leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223325 was assigned to this vulnerability. | ||||
| CVE-2023-1495 | 1 Ruifang-tech | 1 Rebuild | 2025-02-26 | 6.3 Medium |
| A vulnerability classified as critical was found in Rebuild up to 3.2.3. Affected by this vulnerability is the function queryListOfConfig of the file /admin/robot/approval/list. The manipulation of the argument q leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c9474f84e5f376dd2ade2078e3039961a9425da7. It is recommended to apply a patch to fix this issue. The identifier VDB-223381 was assigned to this vulnerability. | ||||
| CVE-2023-25924 | 1 Ibm | 1 Security Key Lifecycle Manager | 2025-02-26 | 5.4 Medium |
| IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630. | ||||
| CVE-2023-25923 | 1 Ibm | 1 Security Key Lifecycle Manager | 2025-02-26 | 2.7 Low |
| IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to incorrect authorization. IBM X-Force ID: 247629. | ||||
| CVE-2023-25684 | 1 Ibm | 1 Security Key Lifecycle Manager | 2025-02-26 | 6.5 Medium |
| IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 247597. | ||||
| CVE-2023-26784 | 1 Tosec | 1 Kirin Fortress Machine | 2025-02-26 | 9.8 Critical |
| SQL Injection vulnerability found in Kirin Fortress Machine v.1.7-2020-0610 allows attackers to execute arbitrary code via the /admin.php?controller=admin_commonuser parameter. | ||||
| CVE-2023-1261 | 1 Silabs | 1 Wi-sun Software Development Kit | 2025-02-26 | 8.2 High |
| Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network. | ||||
| CVE-2023-1262 | 1 Silabs | 2 Wireless Smart Ubiquitous Network Linux Border Router, Wireless Smart Ubiquitous Network Linux Border Router Firmware | 2025-02-26 | 8.2 High |
| Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network. | ||||
| CVE-2023-27037 | 1 Qibosoft | 1 Qibocms | 2025-02-26 | 8.8 High |
| Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at label_set_rs.php | ||||
| CVE-2023-27638 | 1 Tshirtecommerce | 1 Custom Product Designer | 2025-02-26 | 9.8 Critical |
| An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023. | ||||
| CVE-2023-27637 | 1 Tshirtecommerce | 1 Custom Product Designer | 2025-02-26 | 9.8 Critical |
| An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023. | ||||