Lucene search
+L

219894 matches found

Nuclei
Nuclei
added 18 hours ago70 views

Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'aid' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

7.5CVSS9AI score0.01735EPSS
SaveExploits0References3
Nuclei
Nuclei
added 18 hours ago82 views

GamiPress <= 2.8.9 - SQL Injection

GamiPress WordPress plugin version 2.8.9 and below suffers from an SQL injection vulnerability due to insufficient sanitization of user input, allowing attackers to execute arbitrary SQL commands. id: CVE-2024-13496 info: name: GamiPress = 2.8.9 - SQL Injection author: ritikchaddha severity: high...

7.5CVSS9.3AI score0.02187EPSS
SaveExploits0References2
Nuclei
Nuclei
added 18 hours ago86 views

WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection

WordPress WP TripAdvisor Review Slider plugin before 10.8 is susceptible to authenticated SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. This can lead...

8.8CVSS8.2AI score0.04356EPSS
SaveExploits2References4
Nuclei
Nuclei
added 18 hours ago112 views

Jeecg-boot 3.5.0 qurestSql - SQL Injection

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. id: CVE-2023-1454 info: name: Jeecg-boot 3.5...

9.8CVSS6.3AI score0.35825EPSS
SaveExploits3References5
Nuclei
Nuclei
added 18 hours ago50 views

WordPress JoomSport <5.2.8 - SQL Injection

WordPress JoomSport plugin before 5.2.8 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operation...

9.8CVSS9.1AI score0.04756EPSS
SaveExploits2References5
Nuclei
Nuclei
added 18 hours ago272 views

WordPress HTML5 Video Player - SQL Injection

WordPress HTML5 Video Player plugin is vulnerable to SQL injection. An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks. id: CVE-2024-1061 info: name: WordPress HTML5 Video Player - SQL Injection author: xxcdd severity: critical description: | WordPress HTM...

9.8CVSS8.8AI score0.11215EPSS
SaveExploits1References5
Nuclei
Nuclei
added 18 hours ago86 views

Registrations for the Events Calendar < 2.7.6 - SQL Injection

The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the eventid in the rtecsendunregisterlink AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL injection. id:...

9.8CVSS8.9AI score0.07474EPSS
SaveExploits2References3
Nuclei
Nuclei
added 18 hours ago160 views

Ivanti EPM - Remote Code Execution

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. id: CVE-2024-29824 info: name: Ivanti EPM - Remote Code Execution author: DhiyaneshDK severity: critical description: | ...

9.6CVSS9.7AI score0.99951EPSS
SaveExploits5References4
Nuclei
Nuclei
added 18 hours ago90 views

Exrick XMall - SQL Injection

XMall v1.1 was discovered to contain a SQL injection vulnerability via the 'orderDir' parameter. id: CVE-2024-24112 info: name: Exrick XMall - SQL Injection author: DhiyaneshDk severity: critical description: | XMall v1.1 was discovered to contain a SQL injection vulnerability via the 'orderDir'...

9.8CVSS8.9AI score0.03348EPSS
SaveExploits1References2
Nuclei
Nuclei
added 18 hours ago19 views

MyStyle Custom Product Designer <= 3.21.1 - SQL Injection

The MyStyle Custom Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.21.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...

9.3CVSS5.8AI score0.01308EPSS
SaveExploits0References1
Nuclei
Nuclei
added 18 hours ago95 views

PrestaShop Theme Volty CMS Blog - SQL Injection

In the module 'Theme Volty CMS Blog' tvcmsblog up to versions 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. id: CVE-2023-39650 info: name: PrestaShop Theme Volty CMS Blog - SQL Injection author: mastercho severity: critical description: | In the...

9.8CVSS8.8AI score0.03631EPSS
SaveExploits1References2
Nuclei
Nuclei
added 18 hours ago17 views

PHPGurukul Hospital Management System 4.0 - SQL Injection

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain sensitive database information. id: CVE-2020-22165 info: name: PHPGurukul Hospital Management System 4.0 - SQL Injection...

7.5CVSS7.8AI score0.06348EPSS
SaveExploits1References2
Nuclei
Nuclei
added 18 hours ago199 views

Jms Blog - SQL Injection

The module Jms Blog jmsblog from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes id: CVE-2023-27034 info: name: Jms Blog - SQL Injection author: MaStErChO severity: critical...

9.8CVSS9AI score0.58743EPSS
SaveExploits0References5
NVD
NVD
added 19 hours ago8 views

CVE-2026-19973

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The...

6.5CVSS
SaveExploits0References6
GithubExploit
GithubExploit
added 20 hours ago19 views

Exploit for CVE-2026-74251

Unauthenticated SQL Injection via Attribute Filter in Phoca Ca...

9.3CVSS7.2AI score
SaveExploits1
ATTACKERKB
ATTACKERKB
added 20 hours ago3 views

CVE-2026-19973

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The...

6.5CVSS6.3AI score
SaveExploits0References6Affected Software1
Cvelist
Cvelist
added 20 hours ago9 views

CVE-2026-19973 itsourcecode Hospital Management System viewpaymentreport.php sql injection

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The...

6.5CVSS
SaveExploits0References6
CVE
CVE
added 20 hours ago20 views

CVE-2026-19973

CVE-2026-19973 affects itsourcecode Hospital Management System 1.0. An SQL injection vulnerability exists in the unknown functionality of /viewpaymentreport.php when manipulating the delid parameter, exploitable remotely. Public exploit is indicated. CVSS metrics from VulDB suggest a medium sever...

6.5CVSS6.4AI score
SaveExploits0References6
EUVD
EUVD
added 20 hours ago7 views

EUVD-2026-60024

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The...

6.5CVSS6.4AI score
SaveExploits0References6
CVE
CVE
added 20 hours ago18 views

CVE-2026-19972

CVE-2026-19972 affects itsourcecode Hospital Management System 1.0, with SQL injection in an unknown function of /viewpatient.php via the delid parameter. Remote exploitation is possible, and public disclosure of the exploit is noted. Metrics indicate PoC exploit maturity (CVSS v4.0: 5.3 base, NE...

6.5CVSS6.4AI score
SaveExploits0References6
Rows per page
Query Builder