Total
20788 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-37906 | 1 Admidio | 1 Admidio | 2026-06-17 | N/A | 9.9 CRITICAL |
| Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9. | |||||
| CVE-2024-37896 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.6.5 has SQL injection vulnerability. The SQL injection vulnerabilities occur when a web application allows users to input data into SQL queries without sufficiently validating or sanitizing the input. Failing to properly enforce restrictions on user input could mean that even a basic form input field can be used to inject arbitrary and potentially dangerous SQL commands. This could lead to unauthorized access to the database, data leakage, data manipulation, or even complete compromise of the database server. This vulnerability has been addressed in commit `53d033821` which has been included in release version 2.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2024-37873 | 1 Itsourcecode | 1 Payroll Management System Project In Php With Source Code | 2026-06-17 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in view_payslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||||
| CVE-2024-37872 | 1 Angeljudesuarez | 1 Billing System | 2026-06-17 | N/A | 8.1 HIGH |
| SQL injection vulnerability in process.php in Itsourcecode Billing System in PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. | |||||
| CVE-2024-37871 | 1 Emiloi | 1 Online Discussion Forum | 2026-06-17 | N/A | 8.2 HIGH |
| SQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the email parameter. | |||||
| CVE-2024-37870 | 1 Itsourcecode | 1 Learning Management System | 2026-06-17 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in processscore.php in Learning Management System Project In PHP With Source Code 1.0 allows attackers to execute arbitrary SQL commands via the id parameter. | |||||
| CVE-2024-37849 | 1 Itsourcecode | 1 Billing System | 2026-06-17 | N/A | 9.8 CRITICAL |
| A SQL Injection vulnerability in itsourcecode Billing System 1.0 allows a local attacker to execute arbitrary code in process.php via the username parameter. | |||||
| CVE-2024-37848 | 1 Angeljudesuarez | 1 Online Book Store Project | 2026-06-17 | N/A | 8.4 HIGH |
| SQL Injection vulnerability in Online-Bookstore-Project-In-PHP v1.0 allows a local attacker to execute arbitrary code via the admin_delete.php component. | |||||
| CVE-2024-37843 | 1 Craftcms | 1 Craft Cms | 2026-06-17 | N/A | 9.8 CRITICAL |
| Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. | |||||
| CVE-2024-37840 | 1 Itsourcecode | 1 Learning Management System | 2026-06-17 | N/A | 8.8 HIGH |
| SQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remote attackers to execute arbitrary SQL commands via the LessonID parameter. | |||||
| CVE-2024-37831 | 1 Itsourcecode | 1 Payroll Management System | 2026-06-17 | N/A | 9.8 CRITICAL |
| Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. | |||||
| CVE-2024-37802 | 1 Health Care Hospital Management System Project | 1 Health Care Hospital Management System | 2026-06-17 | N/A | 8.8 HIGH |
| CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Patient Info module via the searvalu parameter. | |||||
| CVE-2024-37799 | 1 Code-projects | 1 Restaurant Reservation System | 2026-06-17 | N/A | 5.4 MEDIUM |
| CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_reservations.php. | |||||
| CVE-2024-37791 | 2026-06-17 | N/A | 6.0 MEDIUM | ||
| DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id. | |||||
| CVE-2024-37765 | 1 Machform | 1 Machform | 2026-06-17 | N/A | 8.8 HIGH |
| Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. | |||||
| CVE-2024-37699 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption. | |||||
| CVE-2024-37564 | 2026-06-17 | N/A | 8.5 HIGH | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PayPlus LTD PayPlus Payment Gateway.This issue affects PayPlus Payment Gateway: from n/a through 7.0.7. | |||||
| CVE-2024-37494 | 1 Kainelabs | 1 Youzify | 2026-06-17 | N/A | 8.5 HIGH |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a through 1.2.5. | |||||
| CVE-2024-37486 | 1 Strangerstudios | 1 Paid Memberships Pro | 2026-06-17 | N/A | 7.6 HIGH |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5. | |||||
| CVE-2024-37393 | 1 Securenvoy | 1 Multi-factor Authentication Solutions | 2026-06-17 | N/A | 7.5 HIGH |
| Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature. | |||||