Export limit exceeded: 41104 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (41104 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-4242 | 1 Phpgurukul | 1 Online Birth Certificate System | 2025-05-09 | 7.3 High |
| A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/between-dates-report.php. The manipulation of the argument fromdate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. | ||||
| CVE-2025-4309 | 1 Phpgurukul | 1 Art Gallery Management System | 2025-05-09 | 7.3 High |
| A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add-art-type.php. The manipulation of the argument arttype leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2023-49334 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2025-05-09 | 8.3 High |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report. | ||||
| CVE-2023-49333 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2025-05-09 | 8.3 High |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature. | ||||
| CVE-2024-21791 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2025-05-09 | 4.7 Medium |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability. | ||||
| CVE-2023-49335 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2025-05-09 | 8.3 High |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details. | ||||
| CVE-2023-49332 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2025-05-09 | 8.3 High |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares. | ||||
| CVE-2023-49331 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2025-05-09 | 8.3 High |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option. | ||||
| CVE-2021-38217 | 1 Sem-cms | 1 Semcms | 2025-05-08 | 9.8 Critical |
| SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php. | ||||
| CVE-2022-43413 | 1 Jenkins | 1 Job Import | 2025-05-08 | 4.3 Medium |
| Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2022-43408 | 2 Jenkins, Redhat | 3 Pipeline\, Ocp Tools, Openshift | 2025-05-08 | 6.5 Medium |
| Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins. | ||||
| CVE-2022-43407 | 2 Jenkins, Redhat | 3 Pipeline\, Ocp Tools, Openshift | 2025-05-08 | 8.8 High |
| Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is not correctly encoded, allowing attackers able to configure Pipelines to have Jenkins build URLs from 'input' step IDs that would bypass the CSRF protection of any target URL in Jenkins when the 'input' step is interacted with. | ||||
| CVE-2022-43168 | 1 Rukovoditel | 1 Rukovoditel | 2025-05-08 | 9.8 Critical |
| Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter. | ||||
| CVE-2022-41709 | 1 Markdownify Project | 1 Markdownify | 2025-05-08 | 7.8 High |
| Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled. | ||||
| CVE-2024-25302 | 1 Remyandrade | 1 Event Student Attendance System | 2025-05-08 | 9.8 Critical |
| Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter. | ||||
| CVE-2024-24112 | 1 Exrick | 1 Xmall | 2025-05-08 | 9.8 Critical |
| xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter. | ||||
| CVE-2024-24003 | 1 Jishenghua | 1 Jsherp | 2025-05-08 | 9.8 Critical |
| jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection. | ||||
| CVE-2022-43431 | 1 Jenkins | 1 Compuware Strobe Measurement | 2025-05-08 | 4.3 Medium |
| Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2022-43427 | 1 Jenkins | 1 Compuware Topaz For Total Test | 2025-05-08 | 4.3 Medium |
| Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2022-43421 | 1 Jenkins | 1 Tuleap Git Branch Source | 2025-05-08 | 5.3 Medium |
| A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value. | ||||