Total
11593 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-25157 | 1 Advantech | 1 R-seenet | 2020-10-22 | 5.0 MEDIUM | 7.5 HIGH |
| The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive information. | |||||
| CVE-2019-4680 | 1 Ibm | 1 Sterling B2b Integrator | 2020-10-20 | 6.5 MEDIUM | 8.8 HIGH |
| IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.2.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171733. | |||||
| CVE-2020-7383 | 1 Rapid7 | 1 Nexpose | 2020-10-19 | 5.5 MEDIUM | 8.1 HIGH |
| A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to access resources & make changes they should not have been able to access. | |||||
| CVE-2018-6373 | 1 Fastballproductions | 1 Fastball | 2020-10-19 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action. | |||||
| CVE-2020-15176 | 1 Glpi-project | 1 Glpi | 2020-10-16 | 5.0 MEDIUM | 8.6 HIGH |
| In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2 | |||||
| CVE-2020-15849 | 1 Re-desk | 1 Re\ | 2020-10-16 | 6.5 MEDIUM | 7.2 HIGH |
| Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates() method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for authorization bypass and taking over additional accounts by means of modifying password-reset tokens stored in the database. Remote command execution is also possible by leveraging this to abuse the Yii framework's bizRule functionality, allowing for arbitrary PHP code to be executed by the application. Remote command execution is also possible by using this together with a separate insecure file upload vulnerability (CVE-2020-15488). | |||||
| CVE-2020-24568 | 1 Mbconnectline | 2 Mbconnect24, Mymbconnect24 | 2020-10-15 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing logged-in attackers to discover arbitrary information. | |||||
| CVE-2020-15226 | 1 Glpi-project | 1 Glpi | 2020-10-14 | 5.0 MEDIUM | 4.3 MEDIUM |
| In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory. | |||||
| CVE-2020-15927 | 1 Zohocorp | 1 Manageengine Applications Manager | 2020-10-14 | 6.5 MEDIUM | 8.8 HIGH |
| Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module. | |||||
| CVE-2020-16267 | 1 Zohocorp | 1 Manageengine Applications Manager | 2020-10-14 | 6.5 MEDIUM | 8.8 HIGH |
| Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module. | |||||
| CVE-2020-15533 | 1 Zohocorp | 1 Manageengine Applications Manager | 2020-10-13 | 7.5 HIGH | 9.8 CRITICAL |
| In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack. | |||||
| CVE-2020-26518 | 1 Artica | 1 Pandora Fms | 2020-10-09 | 7.5 HIGH | 9.8 CRITICAL |
| Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_generator.php session_id parameter. | |||||
| CVE-2020-15487 | 1 Re-desk | 1 Re\ | 2020-10-09 | 7.5 HIGH | 9.8 CRITICAL |
| Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria() function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution is possible by using this SQL injection to update certain database values, which are then executed by a bizRule eval() function in the yii/framework/web/auth/CAuthManager.php file. Resultant authorization bypass is also possible, by recovering or modifying password hashes and password reset tokens, allowing for administrative privileges to be obtained. | |||||
| CVE-2020-24569 | 1 Mbconnectline | 2 Mbconnect24, Mymbconnect24 | 2020-10-09 | 4.0 MEDIUM | 4.3 MEDIUM |
| An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information. | |||||
| CVE-2020-25762 | 1 Seat Reservation System Project | 1 Seat Reservation System | 2020-10-08 | 6.4 MEDIUM | 9.1 CRITICAL |
| An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract sensitive information etc. | |||||
| CVE-2019-7316 | 1 Css-tricks | 1 Chat2 | 2020-10-07 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability. | |||||
| CVE-2020-26525 | 1 Damstratechnology | 1 Smart Asset | 2020-10-06 | 6.4 MEDIUM | 9.1 CRITICAL |
| Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers. | |||||
| CVE-2020-25990 | 1 Websitebaker | 1 Websitebaker | 2020-10-05 | 7.5 HIGH | 9.8 CRITICAL |
| WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. | |||||
| CVE-2020-20800 | 1 Metinfo | 1 Metinfo | 2020-10-02 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI. | |||||
| CVE-2020-26042 | 1 Hoosk | 1 Hoosk | 2020-10-02 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php | |||||