Export limit exceeded: 46487 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46487 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-2052 | 1 Phpgurukul | 1 Apartment Visitors Management System | 2025-05-08 | 6.3 Medium |
| A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /forgot-password.php. The manipulation of the argument contactno leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-2057 | 1 Phpgurukul | 1 Emergency Ambulance Hiring Portal | 2025-05-08 | 7.3 High |
| A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/about-us.php. The manipulation of the argument pagedes leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-2058 | 1 Phpgurukul | 1 Emergency Ambulance Hiring Portal | 2025-05-08 | 7.3 High |
| A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2023-50347 | 1 Hcltech | 1 Dryice Myxalytics | 2025-05-08 | 3.7 Low |
| HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries. A malicious user can run arbitrary SQL commands including changing system configuration. | ||||
| CVE-2023-30586 | 1 Nodejs | 1 Node.js | 2025-05-08 | 7.5 High |
| A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. | ||||
| CVE-2023-23918 | 2 Nodejs, Redhat | 4 Node.js, Enterprise Linux, Rhel Eus and 1 more | 2025-05-08 | 7.5 High |
| A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. | ||||
| CVE-2024-25215 | 1 Sherlock | 1 Employee Management System | 2025-05-08 | 9.8 Critical |
| Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aprocess.php. | ||||
| CVE-2022-42021 | 1 Best Student Result Management System Project | 1 Best Student Result Management System | 2025-05-08 | 9.8 Critical |
| Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=. | ||||
| CVE-2024-22917 | 1 Lopalopa | 1 Dynamic Lab Management System | 2025-05-08 | 8.6 High |
| SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script. | ||||
| CVE-2024-24310 | 1 Ethercreation | 1 Generate Barcode On Invoice \/ Delivery Slip | 2025-05-08 | 8.8 High |
| In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can perform SQL injection. | ||||
| CVE-2024-23763 | 1 Gambio | 1 Gambio | 2025-05-07 | 9.8 Critical |
| SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiers[attribute][] parameter. | ||||
| CVE-2024-0566 | 1 Storeapps | 1 Smart Manager | 2025-05-07 | 7.2 High |
| The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. | ||||
| CVE-2023-50981 | 1 Cryptopp | 1 Crypto\+\+ | 2025-05-07 | 7.5 High |
| ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853. | ||||
| CVE-2022-3395 | 1 Soflyy | 1 Wp All Export | 2025-05-07 | 8.8 High |
| The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been given permission to run exports to execute arbitrary SQL statements, leading to a SQL Injection vulnerability. By default only users with the Administrator role can perform exports, but this can be delegated to lower privileged users as well. | ||||
| CVE-2022-3246 | 1 Adenion | 1 Blog2social | 2025-05-07 | 8.8 High |
| The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers | ||||
| CVE-2024-25108 | 1 Pixelfed | 1 Pixelfed | 2025-05-07 | 9.9 Critical |
| Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-23833 | 1 Openrefine | 1 Openrefine | 2025-05-07 | 7.5 High |
| OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server. This issue has been addressed in version 3.7.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2023-6898 | 1 Mayurik | 1 Best Courier Management System | 2025-05-07 | 5.5 Medium |
| A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248256. | ||||
| CVE-2025-4151 | 1 Phpgurukul | 1 Curfew E-pass Management System | 2025-05-07 | 7.3 High |
| A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/pass-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. | ||||
| CVE-2025-4152 | 1 Phpgurukul | 1 Online Birth Certificate System | 2025-05-07 | 7.3 High |
| A vulnerability classified as critical has been found in PHPGurukul Online Birth Certificate System 1.0. Affected is an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. | ||||