840 matches found
CVE-2022-28421: Improper Neutralization of Special Elements used in an SQL Command
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=posts&action=display&value=1&postid=...
CVE-2022-28426: Improper Neutralization of Special Elements used in an SQL Command
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=edit&roleid=...
CVE-2022-28422: Improper Neutralization of Special Elements used in an SQL Command
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit...
CVE-2022-28433: Improper Neutralization of Special Elements used in an SQL Command
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Show&userid=...
CVE-2022-28436: Improper Neutralization of Special Elements used in an SQL Command
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Hide&userid=...
CVE-2022-28035: Improper Neutralization of Special Elements used in an SQL Command
Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminajaxblur-save.php...
PT-2022-18441
Name of the Vulnerable Software and Affected Versions Roothub version 2.6.0 Description The issue allows unauthorized attackers to execute arbitrary SQL commands remotely via the s parameter in the Topics Counting feature. This enables attackers to potentially access or manipulate sensitive data...
CVE-2022-27386: Improper Neutralization of Special Elements used in an SQL Command
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sqlclass.cc...
CVE-2022-27378: Improper Neutralization of Special Elements used in an SQL Command
An issue in the component Createtmptable::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service DoS via specially crafted SQL statements...
CVE-2021-26114: Improper Neutralization of Special Elements used in an SQL Command
Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests...
CVE-2021-32953: Improper Neutralization of Special Elements used in an SQL Command
An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login...
CVE-2021-32957: Improper Neutralization of Special Elements used in an SQL Command
A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is...
CVE-2021-43484: Improper Neutralization of Special Elements used in an SQL Command
A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...
CVE-2022-0478: Improper Neutralization of Special Elements used in an SQL Command
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the postauthorgutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection...
ROS-20220309-01
A vulnerability in the cyrus-sasl authentication mechanism implementation is related to insufficient password cleansing in the SQL plug-in provided with Cyrus SASL. Exploitation of the vulnerability could allow an attacker, acting remotely, send a specially crafted query to a vulnerable applicati...
CVE-2022-23911: Improper Neutralization of Special Elements used in an SQL Command
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection...
PT-2022-11335
Name of the Vulnerable Software and Affected Versions Sourcecodester Storage Unit Rental Management System version v1 Description The issue allows attackers to execute arbitrary SQL commands via the username parameter to the "/storage/classes/Login.php" API endpoint. This enables potential...
CVE-2022-0258
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...
