PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter.

CVE-2018-10915HIGHCVSS 8.5EG 7.5

2018-08-09

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters…

CVE-2018-1096MEDIUMCVSS 6.5EG 6.5

2018-04-05

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.

CVE-2018-10969CRITICALCVSS 9.8EG 9.8

2018-06-17

SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.

CVE-2018-10997CRITICALCVSS 9.8EG 9.8

2018-06-17

Etere EtereWeb before 28.1.20 has a pre-authentication blind SQL injection in the POST parameters txUserName and txPassword.

CVE-2018-11032CRITICALCVSS 9.8EG 9.8

2018-05-14

PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search() function.

CVE-2018-11065LOWCVSS 2.7EG 4.3

2018-08-24

The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injection vulnerability. A malicious user could potentially exploit this vulnerability t…

CVE-2018-11136CRITICALCVSS 9.8EG 9.8

2018-05-31

The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, a blind time-based type).

CVE-2018-11140CRITICALCVSS 9.8EG 9.8

2018-05-31

The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, an error-based type).

CVE-2018-11231HIGHCVSS 8.1EG 8.1

2018-05-23

In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential information.

CVE-2018-11309CRITICALCVSS 9.8EG 9.8

2018-05-28

Blind SQL injection in coupon_code in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request.

CVE-2018-1132HIGHCVSS 7.5EG 9.8

2018-06-20

A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it wa…

CVE-2018-11369CRITICALCVSS 9.8EG 9.8

2018-05-22

An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the database via the \apps\home\controller\ParserController.php scode parameter.

CVE-2018-11372CRITICALCVSS 9.8EG 9.8

2018-05-22

iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.

CVE-2018-11373CRITICALCVSS 9.8EG 9.8

2018-05-22

iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.

CVE-2018-11414HIGHCVSS 8.8EG 8.8

2018-05-24

An issue was discovered in BearAdmin 0.5. There is admin/admin_log/index.html?user_id= SQL injection because admin\controller\AdminLog.php constructs a MySQL query improperly.

CVE-2018-11444CRITICALCVSS 9.8EG 9.8

2018-05-25

A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0.

CVE-2018-11470HIGHCVSS 8.8EG 8.8

2018-05-25

iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.

CVE-2018-11511CRITICALCVSS 9.8EG 9.8

2018-08-16

The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.

CVE-2018-11515CRITICALCVSS 9.8EG 9.8

2018-05-28

The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter.

CVE-2018-11528CRITICALCVSS 9.8EG 9.8

2018-05-29

WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.

CVE-2018-11535CRITICALCVSS 9.8EG 9.8

2018-05-29

An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.

CVE-2018-11589CRITICALCVSS 9.8EG 9.8

2018-06-25

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the sear…

CVE-2018-11643HIGHCVSS 8.8EG 8.8

2018-07-03

SQL injection vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to execute arbitrary SQL commands via the filterPattern parameter.

CVE-2018-11722CRITICALCVSS 9.8EG 9.8

2018-06-05

WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.

CVE-2018-11772HIGHCVSS 7.2EG 7.2

2019-07-29

Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection…

CVE-2018-11774HIGHCVSS 7.2EG 7.2

2019-07-29

Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL …

CVE-2018-11800CRITICALCVSS 9.8EG 9.8

2019-06-11

SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related table.

CVE-2018-11801CRITICALCVSS 9.8EG 9.8

2019-06-11

SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table.

CVE-2018-12039CRITICALCVSS 9.8EG 9.8

2018-06-07

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring.

CVE-2018-12052CRITICALCVSS 9.8EG 9.8

2018-06-08

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.

CVE-2018-12055CRITICALCVSS 9.8EG 9.8

2018-06-08

Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.php, faq.php, about.php, photo_gallery.php, privacy.php, and so on.

CVE-2018-12110HIGHCVSS 7.2EG 7.2

2018-06-11

portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter.

CVE-2018-12250HIGHCVSS 7.2EG 7.2

2019-07-03

An issue was discovered in Elite CMS Pro 2.01. In /admin/add_sidebar.php, the ?page= parameter is vulnerable to SQL injection.

CVE-2018-12254HIGHCVSS 8.8EG 8.8

2018-06-12

router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 component for Joomla! allows SQL Injection via the PATH_INFO to a home/requested_user/Sent%20interest/ URI.

CVE-2018-12295CRITICALCVSS 9.8EG 9.8

2019-05-13

SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter.

CVE-2018-12464CRITICALCVSS 10.0EG 9.8

2018-06-29

A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be explo…

CVE-2018-12470CRITICALCVSS 9.8EG 9.8

2018-10-04

A SQL Injection in the RegistrationSharing module of SUSE Linux SMT allows remote attackers to cause execute arbitrary SQL statements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.

CVE-2018-12482HIGHCVSS 8.8EG 8.8

2018-08-04

OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues.

CVE-2018-12498CRITICALCVSS 9.8EG 9.8

2018-06-15

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php.

CVE-2018-1252HIGHCVSS 8.8EG 8.8

2018-06-05

RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications. An authenticated malicious user with low privileges could potentially exploit this vulnerability to ex…

CVE-2018-12534CRITICALCVSS 9.8EG 9.8

2018-06-18

A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress.

CVE-2018-12630CRITICALCVSS 9.8EG 9.8

2018-06-21

NEWMARK (aka New Mark) NMCMS 2.1 allows SQL Injection via the sect_id parameter to the /catalog URI.

CVE-2018-12636HIGHCVSS 7.2EG 7.2

2018-06-22

The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.

CVE-2018-1280HIGHCVSS 7.5EG 7.5

2018-05-11

Pivotal Greenplum Command Center versions 2.x prior to 2.5.1 contains a blind SQL injection vulnerability. An unauthenticated user can perform a SQL injection in the command center which results in disclosure of database contents.

CVE-2018-1282CRITICALCVSS 9.1EG 9.1

2018-04-05

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.

CVE-2018-1289HIGHCVSS 8.8EG 8.8

2018-04-20

In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' and 'sortOrder' which are appended dir…

CVE-2018-1290CRITICALCVSS 9.8EG 9.8

2018-04-20

In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injection. This could be done in Methods like retrieveAuditEntries …

CVE-2018-1291HIGHCVSS 8.1EG 8.1

2018-04-20

Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' which are appended directly with SQL statements. A hacker/user…

CVE-2018-12912HIGHCVSS 7.2EG 7.2

2018-06-27

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.

CWE-89— SQL Injection

CVEs classified under CWE-89page 91 of 371

Map vulnerabilities like CWE-89 to your infrastructure