Total
20802 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-54359 | 2026-06-17 | N/A | 8.2 HIGH | ||
| WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service. | |||||
| CVE-2023-54340 | 2026-06-17 | N/A | 8.2 HIGH | ||
| WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password parameters. Attackers can inject malicious SQL queries using techniques like OR '1'='1' and stacked queries to access database information or execute administrative commands. | |||||
| CVE-2023-54333 | 2026-06-17 | N/A | 8.2 HIGH | ||
| Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads to retrieve and potentially steal entire database contents. | |||||
| CVE-2023-54163 | 1 Nlb | 1 Mklik Makedonija | 2026-06-17 | N/A | 7.5 HIGH |
| NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through unsanitized input to potentially disclose sensitive information from the mobile banking application. | |||||
| CVE-2023-53982 | 1 Sigb | 1 Pmb | 2026-06-17 | N/A | 7.5 HIGH |
| PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection attacks. | |||||
| CVE-2023-53975 | 1 Thedigitalcraft | 1 Atomcms | 2026-06-17 | N/A | 7.5 HIGH |
| Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks. | |||||
| CVE-2023-53972 | 1 Webtareas Project | 1 Webtareas | 2026-06-17 | N/A | 7.5 HIGH |
| WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data. | |||||
| CVE-2023-53960 | 1 Sound4 | 17 Big Voice2, Big Voice2 Firmware, Big Voice4 and 14 more | 2026-06-17 | N/A | 9.8 CRITICAL |
| SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access to the system. | |||||
| CVE-2023-53935 | 2026-06-17 | N/A | 5.4 MEDIUM | ||
| WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attackers can inject crafted SQL statements using UNION-based techniques to extract sensitive database information by sending malformed requests to the ticket endpoint. | |||||
| CVE-2023-53926 | 1 Phpjabbers | 1 Simple Cms | 2026-06-17 | N/A | 9.8 CRITICAL |
| PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify database information. | |||||
| CVE-2023-53917 | 1 Powerstonegh | 1 Affiliate Me | 2026-06-17 | N/A | 6.5 MEDIUM |
| Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated administrators to manipulate database queries. Attackers can exploit the 'id' parameter with crafted union-based queries to extract sensitive user information including usernames and password hashes. | |||||
| CVE-2023-53877 | 1 Phpjabbers | 1 Bus Reservation System | 2026-06-17 | N/A | 9.8 CRITICAL |
| Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to steal information from the database. | |||||
| CVE-2023-53734 | 2026-06-17 | N/A | N/A | ||
| dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access. | |||||
| CVE-2023-52335 | 1 Advantech | 1 Iview | 2026-06-17 | N/A | 7.5 HIGH |
| Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ConfigurationServlet servlet, which listens on TCP port 8080 by default. When parsing the column_value element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-17863. | |||||
| CVE-2023-52290 | 1 Apache | 1 Streampark | 2026-06-17 | N/A | 8.1 HIGH |
| In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection vulnerability. The attacker must successfully log into the system to launch an attack, which may cause data leakage. Since no data will be written, so this is a low-impact vulnerability. Mitigation: all users should upgrade to 2.1.4, Such parameters will be blocked. | |||||
| CVE-2023-52285 | 1 Lrx0014 | 1 Examsys | 2026-06-17 | N/A | 7.5 HIGH |
| ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter. | |||||
| CVE-2023-52215 | 1 Ukrsolution | 1 Barcode Scanner And Inventory Manager | 2026-06-17 | N/A | 9.3 CRITICAL |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UkrSolution Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: from n/a through 1.5.1. | |||||
| CVE-2023-52204 | 1 Javik | 1 Randomize | 2026-06-17 | N/A | 8.5 HIGH |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Javik Randomize.This issue affects Randomize: from n/a through 1.4.3. | |||||
| CVE-2023-52201 | 1 Briandgoad | 1 Ptypeconverter | 2026-06-17 | N/A | 7.6 HIGH |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brian D. Goad pTypeConverter.This issue affects pTypeConverter: from n/a through 0.2.8.1. | |||||
| CVE-2023-52180 | 1 Really-simple-plugins | 1 Recipe Maker For Your Food Blog From Zip Recipes | 2026-06-17 | N/A | 7.6 HIGH |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.1.0. | |||||