Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (45378 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-48090 1 Hotel Management System Project 1 Hotel Management System 2025-04-07 6.5 Medium
Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php.
CVE-2022-46956 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-04-07 7.2 High
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manage_user.php.
CVE-2022-46955 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-04-07 9.8 Critical
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=save_queue.
CVE-2022-46953 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-04-07 7.2 High
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=save_window.
CVE-2022-46950 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-04-07 7.2 High
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_window.
CVE-2022-46093 1 Hospital Management System Project 1 Hospital Management System 2025-04-07 8.2 High
Hospital Management System v1.0 is vulnerable to SQL Injection. Attackers can gain administrator privileges without the need for a password.
CVE-2024-53258 1 Autolabproject 1 Autolab 2025-04-07 5.3 Medium
Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature.
CVE-2023-22959 1 Webchess Project 1 Webchess 2025-04-07 8.8 High
WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).
CVE-2023-22945 2 Fedoraproject, Mediawiki 2 Fedora, Mediawiki 2025-04-07 4.3 Medium
In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties.
CVE-2022-46954 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-04-07 9.8 Critical
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_transaction.
CVE-2022-46949 1 Helmet Store Showroom Site Project 1 Helmet Store Showroom Site 2025-04-07 7.2 High
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_helmet.
CVE-2022-46947 1 Helmet Store Showroom Site Project 1 Helmet Store Showroom Site 2025-04-07 7.2 High
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category.
CVE-2022-46946 1 Helmet Store Showroom Site Project 1 Helmet Store Showroom Site 2025-04-07 7.2 High
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_brand.
CVE-2022-46502 1 Online Student Enrollment System Project 1 Online Student Enrollment System 2025-04-07 9.8 Critical
Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php.
CVE-2022-46471 1 Online Health Care System Project 1 Online Health Care System 2025-04-07 9.8 Critical
Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/consulting_detail.php.
CVE-2025-0298 1 Code-projects 1 Online Book Shop 2025-04-07 6.3 Medium
A vulnerability was found in code-projects Online Book Shop 1.0. It has been rated as critical. This issue affects some unknown processing of the file /process_login.php. The manipulation of the argument usernm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-0299 1 Code-projects 1 Online Book Shop 2025-04-07 6.3 Medium
A vulnerability classified as critical has been found in code-projects Online Book Shop 1.0. Affected is an unknown function of the file /search_result.php. The manipulation of the argument s leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-0298 1 Firefly-iii 1 Firefly Iii 2025-04-07 6.5 Medium
Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
CVE-2025-3265 1 Phpgurukul 1 E-diary Management System 2025-04-07 7.3 High
A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-category.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-3267 1 Qinguoyi 1 Tinywebserver 2025-04-07 6.3 Medium
A vulnerability, which was classified as critical, was found in qinguoyi TinyWebServer up to 1.0. This affects an unknown part of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.