CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

10440 matches found

CVE•added 2025/10/06 12:02 a.m.•37 views

CVE-2025-11311

Tipray Data Leakage Prevention System 1.0 is affected. The vulnerability lies in the findTenantPage.do file, specifically the findTenantPage function, where manipulation of the sort argument enables SQL injection. Attacks can be initiated remotely, and public exploitation has been disclosed. The ...

9.8CVSS7AI score0.00502EPSS

SaveExploits1References4Affected Software1

Positive Technologies•added 2025/10/06 12:00 a.m.•28 views

PT-2025-40827

Name of the Vulnerable Software and Affected Versions Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 version 1.0 Description A security issue exists in the findTenantPage function of the findTenantPage.do file. Manipulation of the sort argument can lead to SQL injection. This attac...

7.5CVSS7.2AI score0.00502EPSS

SaveExploits1References7

CNNVD•added 2025/10/06 12:00 a.m.•20 views

Tipray Data Leakage Prevention System SQL Injection Vulnerability

Tipray Data Leakage Prevention System is a data leakage prevention system of China Tipray Company. Tipray Data Leakage Prevention System version 1.0 has a SQL injection vulnerability, the vulnerability stems from the incorrect operation of the parameter sort in the file findModulePage.do, which m...

9.8CVSS7.9AI score0.00502EPSS

SaveExploits1References4

Positive Technologies•added 2025/10/05 12:00 a.m.•56 views

PT-2025-40801

Name of the Vulnerable Software and Affected Versions CRMEB versions prior to 5.7 Description A security flaw exists in CRMEB that allows for SQL injection. The issue is related to the processing of the cate id argument within the GET Parameter Handler component, specifically in the file...

8.8CVSS6.3AI score0.00332EPSS

SaveExploits0References9

RedhatCVE•added 2025/10/04 11:53 a.m.•27 views

CVE-2025-9199

The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

6.5CVSS6.6AI score0.00277EPSS

SaveExploits0References1

osv_cve•added 2025/10/03 8:30 p.m.•9 views

CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...

7.1CVSS6AI score

SaveExploits0References4