Total
20789 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-23494 | 1 Deltaww | 1 Diaenergie | 2026-06-17 | N/A | 8.8 HIGH |
| SQL injection vulnerability exists in GetDIAE_unListParameters. | |||||
| CVE-2024-23119 | 1 Centreon | 1 Centreon Web | 2026-06-17 | N/A | 8.8 HIGH |
| Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the insertGraphTemplate function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22339. | |||||
| CVE-2024-23118 | 1 Centreon | 1 Centreon Web | 2026-06-17 | N/A | 7.2 HIGH |
| Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateContactHostCommands function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22298. | |||||
| CVE-2024-23117 | 1 Centreon | 1 Centreon Web | 2026-06-17 | N/A | 7.2 HIGH |
| Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateContactServiceCommands function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22297. | |||||
| CVE-2024-23116 | 1 Centreon | 1 Centreon Web | 2026-06-17 | N/A | 7.2 HIGH |
| Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateLCARelation function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22296. | |||||
| CVE-2024-23115 | 1 Centreon | 1 Centreon Web | 2026-06-17 | N/A | 7.2 HIGH |
| Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateGroups function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22295. | |||||
| CVE-2024-22923 | 1 Advradius | 1 Adv Radius | 2026-06-17 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in adv radius v.2.2.5 allows a local attacker to execute arbitrary code via a crafted script. | |||||
| CVE-2024-22917 | 1 Lopalopa | 1 Dynamic Lab Management System | 2026-06-17 | N/A | 8.6 HIGH |
| SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script. | |||||
| CVE-2024-22856 | 2026-06-17 | N/A | 5.4 MEDIUM | ||
| A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers to execute unintended queries and disclose sensitive information from DB tables via crafted requests. | |||||
| CVE-2024-22719 | 1 Formtools | 1 Form Tools | 2026-06-17 | N/A | 8.1 HIGH |
| SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client. | |||||
| CVE-2024-22628 | 1 Oretnom23 | 1 Budget And Expense Tracker System | 2026-06-17 | N/A | 7.2 HIGH |
| Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&date_end= | |||||
| CVE-2024-22627 | 1 Campcodes | 1 Supplier Management System | 2026-06-17 | N/A | 7.2 HIGH |
| Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_distributor.php?id=. | |||||
| CVE-2024-22626 | 1 Campcodes | 1 Supplier Management System | 2026-06-17 | N/A | 7.2 HIGH |
| Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_retailer.php?id=. | |||||
| CVE-2024-22625 | 1 Campcodes | 1 Supplier Management System | 2026-06-17 | N/A | 7.2 HIGH |
| Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_category.php?id=. | |||||
| CVE-2024-22611 | 1 Open-emr | 1 Openemr | 2026-06-17 | N/A | 9.8 CRITICAL |
| OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php. | |||||
| CVE-2024-22406 | 1 Shopware | 1 Shopware | 2026-06-17 | N/A | 9.3 CRITICAL |
| Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. | |||||
| CVE-2024-22283 | 1 Delhivery | 1 Logistics Courier | 2026-06-17 | N/A | 8.5 HIGH |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delhivery Delhivery Logistics Courier.This issue affects Delhivery Logistics Courier: from n/a through 1.0.107. | |||||
| CVE-2024-22280 | 1 Vmware | 2 Aria Automation, Cloud Foundation | 2026-06-17 | N/A | 8.5 HIGH |
| VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database. | |||||
| CVE-2024-22261 | 1 Linuxfoundation | 1 Harbor | 2026-06-17 | N/A | 2.7 LOW |
| SQL-Injection in Harbor allows priviledge users to leak the task IDs | |||||
| CVE-2024-22221 | 1 Dell | 1 Unity Operating Environment | 2026-06-17 | N/A | 4.5 MEDIUM |
| Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability. An authenticated attacker could potentially exploit this vulnerability, leading to exposure of sensitive information. | |||||