A SQL injection was discovered in /coreframe/app/admin/copyfrom.php in WUZHI CMS 4.1.0 via the index.php?m=core&f=copyfrom&v=listing keywords parameter.

CVE-2018-15894CRITICALCVSS 9.8EG 9.8

2018-08-27

A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyValue parameter.

CVE-2018-15904CRITICALCVSS 9.8EG 9.8

2018-08-27

A10 ACOS Web Application Firewall (WAF) 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.1.2-P4 mishandles the configured rules for blocking SQL injection attacks, aka A10-2017-0008.

CVE-2018-15918MEDIUMCVSS 5.4EG 5.4

2018-09-05

An issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the application without permissions to read and modify sensitive information from the database used by the application via the startdate or enddate param…

CVE-2018-16116HIGHCVSS 8.8EG 8.8

2019-06-20

SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQL commands via the "username" GET parameter.

CVE-2018-16137HIGHCVSS 8.8EG 8.8

2019-05-13

An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections.

CVE-2018-16159CRITICALCVSS 9.8EG 9.8

2018-08-30

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_doajax_front_template request.

CVE-2018-16175HIGHCVSS 7.2EG 7.2

2019-01-09

SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.

CVE-2018-16188CRITICALCVSS 9.8EG 9.8

2019-01-09

SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510,…

CVE-2018-16251MEDIUMCVSS 4.3EG 4.3

2019-06-20

A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters.

CVE-2018-16278CRITICALCVSS 9.8EG 9.8

2018-08-31

phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajax_save_draft function with the dir parameter.

CVE-2018-16353CRITICALCVSS 9.8EG 9.8

2018-09-02

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter.

CVE-2018-16354CRITICALCVSS 9.8EG 9.8

2018-09-02

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter.

CVE-2018-16356CRITICALCVSS 9.8EG 9.8

2020-03-02

An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter.

CVE-2018-16357CRITICALCVSS 9.8EG 9.8

2020-03-02

An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter.

CVE-2018-16384HIGHCVSS 7.5EG 7.5

2018-09-03

A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.

CVE-2018-16385CRITICALCVSS 9.8EG 9.8

2018-09-03

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

CVE-2018-16389MEDIUMCVSS 6.5EG 6.5

2018-09-12

e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter.

CVE-2018-16410MEDIUMCVSS 6.5EG 6.5

2018-09-03

Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php.

CVE-2018-16432CRITICALCVSS 9.8EG 9.8

2018-09-04

BlueCMS 1.6 allows SQL Injection via the user_name parameter to uploads/user.php?act=index_login.

CVE-2018-16436HIGHCVSS 7.2EG 7.2

2018-09-05

Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.

CVE-2018-16445CRITICALCVSS 9.8EG 9.8

2018-09-04

An issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an adm1n/admin_topic_vod.php request.

CVE-2018-16659CRITICALCVSS 9.8EG 9.8

2018-09-28

An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further priv…

CVE-2018-16724CRITICALCVSS 9.8EG 9.8

2018-09-08

An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request.

CVE-2018-1674MEDIUMCVSS 6.3EG 8.8

2018-09-20

IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete inform…

CVE-2018-16762CRITICALCVSS 9.8EG 9.8

2018-09-09

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items.

CVE-2018-16803CRITICALCVSS 9.8EG 9.8

2019-01-10

In CIMTechniques CIMScan 6.x through 6.2, the SOAP WSDL parser allows attackers to execute SQL code.

CVE-2018-16809CRITICALCVSS 9.8EG 9.8

2019-03-07

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.

CVE-2018-16822CRITICALCVSS 9.8EG 9.8

2018-09-21

SeaCMS 6.64 allows SQL Injection via the upload/admin/admin_video.php order parameter.

CVE-2018-16850CRITICALCVSS 9.8EG 9.8

2018-11-13

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with…

CVE-2018-1699MEDIUMCVSS 6.3EG 8.8

2018-08-24

IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database…

CVE-2018-17035CRITICALCVSS 9.8EG 9.8

2018-09-14

UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter.

CVE-2018-17048HIGHCVSS 7.5EG 7.5

2019-05-16

admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection.

CVE-2018-17092MEDIUMCVSS 5.4EG 5.4

2018-09-16

An issue was discovered in DonLinkage 6.6.8. SQL injection in /pages/proxy/php.php and /pages/proxy/add.php can be exploited via specially crafted input, allowing an attacker to obtain information from a database. The vulnerability can onl…

CVE-2018-17110CRITICALCVSS 9.8EG 9.8

2018-09-17

Simple POS 4.0.24 allows SQL Injection via a products/get_products/ columns[0][search][value] parameter in the management panel, as demonstrated by products/get_products/1.

CVE-2018-17129MEDIUMCVSS 4.9EG 4.9

2018-09-17

MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field.

CVE-2018-17136CRITICALCVSS 9.8EG 9.8

2018-09-17

zzcms 8.3 contains a SQL Injection vulnerability in /user/check.php via a Client-Ip HTTP header.

CVE-2018-17179CRITICALCVSS 9.8EG 9.8

2019-05-17

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.

CVE-2018-17181CRITICALCVSS 9.8EG 9.8

2019-05-17

An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php.

CVE-2018-17232CRITICALCVSS 9.8EG 9.8

2018-09-20

SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot (aka slack-archive-bot) before 2018-09-19 allows remote attackers to execute arbitrary SQL commands via the text parameter to cursor.execute().

CVE-2018-17243CRITICALCVSS 9.8EG 9.8

2018-09-20

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.

CVE-2018-17254CRITICALCVSS 9.8EG 9.8

2018-09-20

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.

CVE-2018-17283HIGHCVSS 7.5EG 7.5

2018-09-21

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admi…

CVE-2018-17374CRITICALCVSS 9.8EG 9.8

2019-06-19

SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filter_order_Dir or filter_order parameter.

CVE-2018-17375CRITICALCVSS 9.8EG 9.8

2018-09-28

SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.

CVE-2018-17376CRITICALCVSS 9.8EG 9.8

2018-09-28

SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filter_letter parameter.

CVE-2018-17377CRITICALCVSS 9.8EG 9.8

2018-09-28

SQL Injection exists in the Questions 1.4.3 component for Joomla! via the term, userid, users, or groups parameter.

CVE-2018-17378CRITICALCVSS 9.8EG 9.8

2018-09-28

SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order parameter.

CVE-2018-17379CRITICALCVSS 9.8EG 9.8

2018-09-28

SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order parameter.

CVE-2018-17380CRITICALCVSS 9.8EG 9.8

2018-09-28

SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_end_date parameter.

CWE-89— SQL Injection

CVEs classified under CWE-89page 93 of 371

Map vulnerabilities like CWE-89 to your infrastructure