Total
11593 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-10466 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2018-07-13 | 7.5 HIGH | 9.8 CRITICAL |
| Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection. | |||||
| CVE-2016-6619 | 1 Phpmyadmin | 1 Phpmyadmin | 2018-07-08 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | |||||
| CVE-2016-6616 | 1 Phpmyadmin | 1 Phpmyadmin | 2018-07-08 | 6.8 MEDIUM | 7.5 HIGH |
| An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected. | |||||
| CVE-2018-11140 | 1 Quest | 1 Kace System Management Appliance | 2018-07-02 | 7.5 HIGH | 9.8 CRITICAL |
| The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, an error-based type). | |||||
| CVE-2018-10094 | 1 Dolibarr | 1 Dolibarr | 2018-07-02 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes. | |||||
| CVE-2018-11136 | 1 Quest | 1 Kace System Management Appliance | 2018-06-29 | 7.5 HIGH | 9.8 CRITICAL |
| The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, a blind time-based type). | |||||
| CVE-2018-11535 | 1 Sitemakin | 1 Slac | 2018-06-29 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection. | |||||
| CVE-2018-11309 | 1 Membermouse | 1 Membermouse | 2018-06-28 | 7.5 HIGH | 9.8 CRITICAL |
| Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request. | |||||
| CVE-2018-11515 | 1 Gvectors | 1 Wpforo | 2018-06-28 | 5.0 MEDIUM | 9.8 CRITICAL |
| The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. | |||||
| CVE-2018-11528 | 1 Wuzhicms | 1 Wuzhi Cms | 2018-06-28 | 7.5 HIGH | 9.8 CRITICAL |
| WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI. | |||||
| CVE-2018-11444 | 1 Easyservice Billing Project | 1 Easyservice Billing | 2018-06-27 | 7.5 HIGH | 9.8 CRITICAL |
| A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0. | |||||
| CVE-2018-11470 | 1 Iscripts | 1 Eswap | 2018-06-27 | 6.5 MEDIUM | 8.8 HIGH |
| iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel. | |||||
| CVE-2018-11231 | 1 Divido | 1 Divido | 2018-06-26 | 6.8 MEDIUM | 8.1 HIGH |
| In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential information. | |||||
| CVE-2018-11373 | 1 Iscripts | 1 Eswap | 2018-06-25 | 7.5 HIGH | 9.8 CRITICAL |
| iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter. | |||||
| CVE-2018-11372 | 1 Iscripts | 1 Eswap | 2018-06-25 | 7.5 HIGH | 9.8 CRITICAL |
| iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter. | |||||
| CVE-2018-11414 | 1 Bearadmin Project | 1 Bearadmin | 2018-06-25 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in BearAdmin 0.5. There is admin/admin_log/index.html?user_id= SQL injection because admin\controller\AdminLog.php constructs a MySQL query improperly. | |||||
| CVE-2018-10350 | 2 Linux, Trendmicro | 2 Linux Kernel, Smart Protection Server | 2018-06-25 | 9.0 HIGH | 8.8 HIGH |
| A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw within the handling of parameters provided to wcs\_bwlists\_handler.php. Authentication is required in order to exploit this vulnerability. | |||||
| CVE-2018-10356 | 1 Trendmicro | 1 Email Encryption Gateway | 2018-06-22 | 9.0 HIGH | 8.8 HIGH |
| A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability. | |||||
| CVE-2018-10353 | 1 Trendmicro | 1 Email Encryption Gateway | 2018-06-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| A SQL injection information disclosure vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to disclose sensitive information on vulnerable installations due to a flaw in the formChangePass class. Authentication is required to exploit this vulnerability. | |||||
| CVE-2018-10352 | 1 Trendmicro | 1 Email Encryption Gateway | 2018-06-22 | 6.5 MEDIUM | 8.8 HIGH |
| A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formConfiguration class. Authentication is required to exploit this vulnerability. | |||||