15330 matches found
CVE-2024-33266: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Helloshop deliveryorderautoupdate v.2.8.1 and before allows an attacker to run arbitrary SQL commands via the DeliveryorderautoupdateOrdersModuleFrontController::initContent function...
CVE-2024-33272: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in KnowBand for PrestaShop autosuggest before 2.0.0 allows an attacker to run arbitrary SQL commands via the AutosuggestSearchModuleFrontController::initContent, and AutosuggestSearchModuleFrontController::getKbProducts components...
CVE-2024-33276: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the PreorderModel::getIdProductAttributesByIdAttributes method...
CVE-2024-33268
A SQL Injection vulnerability exists in Digincube mdgiftproduct versions prior to 1.4.1 . The flaw is located in the MdGiftRule::addGiftToCart method, which allows an attacker to execute arbitrary SQL commands. This could lead to unauthorized database queries, resulting in data manipulation or ex...
PrestaShop SQL injection vulnerability
PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image zoom and other features. A SQL injection vulnerability exists in PrestaShop preorderandnotication 3.1.0 and earlier version...
CVE-2024-33268: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Digincube mdgiftproduct before 1.4.1 allows an attacker to run arbitrary SQL commands via the MdGiftRule::addGiftToCart method...
CVE-2024-33276
SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the PreorderModel::getIdProductAttributesByIdAttributes method...
CVE-2024-33276
A SQL Injection vulnerability exists in FME Modules preorderandnotication version 3.1.0 and before . The flaw originates from the PreorderModel::getIdProductAttributesByIdAttributes() method, which allows a remote attacker to execute arbitrary SQL commands. This vulnerability could enable an atta...
CVE-2024-32872 Umbraco Workflow's Backoffice users can execute arbitrary SQL
Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6,...
CVE-2024-30974
SQL Injection vulnerability in autoexpress v.1.3.0 allows attackers to run arbitrary SQL commands via the carId parameter...
CVE-2024-30974: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in autoexpress v.1.3.0 allows attackers to run arbitrary SQL commands via the carId parameter...
NS-ASG Netentsec Admin SQL Injection
The vulnerability of the /admin/configAnticrack.php file of the application security gateway, NS-ASG Netentsec, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries using the GroupId...
CVE-2024-30990
SQL Injection vulnerability in the "Invoices" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL commands via "searchdata" parameter...
CVE-2024-30981: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in /edit-computer-detail.php in phpgurukul Cyber Cafe Management System Using PHP & MySQL v1.0 allows attackers to run arbitrary SQL commands via editid in the application URL...
CVE-2024-30982: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands via the upid parameter in the /view-user-detail.php file...
CVE-2024-30980: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands via the Computer Location parameter in manage-computer.php page...
CVE-2024-30985
SQL Injection vulnerability in "B/W Dates Reports" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL commands via "todate" and "fromdate" parameters...
CVE-2024-22719
SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client...
CVE-2024-22719
An SQL Injection vulnerability exists in Form Tools version 3.1.1 . The flaw originates from the improper neutralization of special elements in the 'keyword' parameter used when searching for a client. This allows an attacker to execute arbitrary SQL commands by manipulating the search functional...