Lucene search
+L

1296 matches found

Nuclei
Nuclei
added 2026/08/29 10:07 a.m.94 views

WordPress Chop Slider 3 - Blind SQL Injection

WordPress Chop Slider 3 plugin contains a blind SQL injection vulnerability via the id GET parameter supplied to getscript/index.php. The plugin can allow an attacker to execute arbitrary SQL queries in the context of the WP database user, thereby making it possible to obtain sensitive informatio...

9.8CVSS7.5AI score0.95657EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.85 views

SkyWalking SQLI

When using H2/MySQL/TiDB as Apache SkyWalking storage and a metadata query through GraphQL protocol, there is a SQL injection vulnerability which allows access to unexpected data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQ...

7.5CVSS7.2AI score0.34613EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.59 views

PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in...

9.8CVSS6.8AI score0.15652EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.147 views

Joomla! Component PrayerCenter 3.0.2 - SQL Injection

SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429. id: CVE-2018-7314 info: name: Joomla! Component PrayerCenter 3.0.2 - SQL Injection author: DhiyaneshDK severity: critical description: | SQL Injection...

9.8CVSS7.3AI score0.37206EPSS
SaveExploits7References4
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.66 views

rConfig <=3.9.4 - SQL Injection

rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10549 info: name: rConfig 3.9.4 or apply th...

9.8CVSS7.2AI score0.32124EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.173 views

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections id: CVE-2021-24791 info: name: Header Footer Code Manag...

7.2CVSS7.2AI score0.05124EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.81 views

WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection

WordPress Paytm Donation plugin through 1.3.2 is susceptible to authenticated SQL injection. The plugin does not sanitize, validate, or escape the id GET parameter before using it in a SQL statement when deleting donations. An attacker can possibly obtain sensitive information, modify data, and/o...

7.2CVSS7.2AI score0.0654EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.91 views

WordPress Asgaros Forum <1.15.13 - SQL Injection

WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

9.8CVSS7.4AI score0.13285EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.67 views

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter. id: CVE-2021-27316 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind SQ...

7.5CVSS7.2AI score0.07826EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.80 views

CSE Bookstore 1.0 - SQL Injection

CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database. id: CVE-2020-36112 info: name: CSE Bookstor...

9.8CVSS7.3AI score0.18052EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.23 views

Fortinet FortiWeb - SQL Injection

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests. id: CVE-2025-25257 info: name: Fortinet FortiWeb - SQL...

9.8CVSS7.5AI score0.99772EPSS
SaveExploits18References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.46 views

Metinfo 7.0.0 beta - SQL Injection

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/language/admin/languagegeneral.class.php via the admin/?n=language&c=languagegeneral&a=doExportPack appno parameter. id: CVE-2019-16997 info: name: Metinfo 7.0.0 beta - SQL Injection author: ritikchaddha severity: high description:...

7.2CVSS7.2AI score0.49398EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.463 views

Magento - SQL Injection

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. id: CVE-2019-7139 info: name: Magento - SQL Injection author: MaStErChO severity: critical description: | An unauthenticated user can execute SQL...

9.8CVSS7.4AI score0.08297EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.97 views

Lansweeper Unauthenticated SQL Injection

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. id: CVE-2019-13462 info: name: Lansweeper Unauthenticated SQL Injection author: divyamudgal severity: critical description: Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. impact: | This vulnerability can lead to...

9.1CVSS7.3AI score0.05638EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.256 views

Rocket.Chat <=3.13 - NoSQL Injection

Rocket.Chat 3.11, 3.12 and 3.13 contains a NoSQL injection vulnerability which allows unauthenticated access to an API endpoint. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected...

9.8CVSS7.3AI score0.95242EPSS
SaveExploits16References6
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.59 views

bloofoxCMS v0.5.2.1 - SQL Injection

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit. id: CVE-2023-34753 info: name: bloofoxCMS v0.5.2.1 - SQL Injection author: theamanrawat severity: critical description: | bloofox v0.5.2.1 was...

9.8CVSS7.3AI score0.04228EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.106 views

CyberPower < v2.8.3 - SQL Injection

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to . id: CVE-2024-32736 info: name: CyberPower PDNU" tags: cve,cve2024,cyberpower,sqli,vkev,vuln http: - method: GET path: - "BaseURL/api/v1/confup?mode=&uid=1'%20UNION%20select%201,2,3,4,sqliteversion;--"...

7.5CVSS7.1AI score0.05408EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.154 views

Dokan Pro <= 3.10.3 - SQL Injection

The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. id: CVE-2024-3922 info: name: Dokan Pro...

10CVSS5.9AI score0.53196EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.51 views

AnteeoWMS < v4.7.34 - SQL Injection

A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB. id: CVE-2024-44349 info: name: AnteeoWMS v4.7.34 - SQL Injection author:...

9.8CVSS6.1AI score0.05778EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.76 views

1Panel SQL Injection - Authenticated

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to...

9.8CVSS7.3AI score0.29183EPSS
SaveExploits1References1
Rows per page
Query Builder