Total
20793 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-30552 | 1 Archerydms | 1 Archery | 2026-06-17 | N/A | 6.5 MEDIUM |
| Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `sql/instance.py` endpoint's `describe` method. In several cases, user input coming from the `tb_name` parameter value, the `db_name` parameter value or the `schema_name` value in the `sql/instance.py` `describe` endpoint is passed to the `describe_table` methods in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. Please take into account that in some cases all three parameter values are concatenated, in other only one or two of them. The affected methods are: `describe_table` in `sql/engines/clickhouse.py`which concatenates input which is passed to execution on the database in the `query` method in `sql/engines/clickhouse.py`, `describe_table` in `sql/engines/mssql.py` which concatenates input which is passed to execution on the database in the `query` methods in `sql/engines/mssql.py`, `describe_table` in `sql/engines/mysql.py`which concatenates input which is passed to execution on the database in the `query` method in `sql/engines/mysql.py`, `describe_table` in `sql/engines/oracle.py` which concatenates input which is passed to execution on the database in the `query` methods in `sql/engines/oracle.py`, `describe_table` in `sql/engines/pgsql.py`which concatenates input which is passed to execution on the database in the `query` methods in `sql/engines/pgsql.py`, `describe_table` in `sql/engines/phoenix.py` which concatenates input which is passed to execution on the database in the `query` method in `sql/engines/phoenix.py`. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-101`. | |||||
| CVE-2023-30545 | 1 Prestashop | 1 Prestashop | 2026-06-17 | N/A | 7.7 HIGH |
| PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9 | |||||
| CVE-2023-30495 | 1 Themefic | 1 Ultimate Addons For Contact Form 7 | 2026-06-17 | N/A | 8.5 HIGH |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23. | |||||
| CVE-2023-30465 | 1 Apache | 1 Inlong | 2026-06-17 | N/A | 5.3 MEDIUM |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the user with ID 1 from the "user" table, one character at a time. Users are advised to upgrade to Apache InLong's 1.6.0 or cherry-pick [1] to solve it. https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html [1] https://github.com/apache/inlong/issues/7529 https://github.com/apache/inlong/issues/7529 | |||||
| CVE-2023-30415 | 1 Oretnom23 | 1 Packers And Movers Management System | 2026-06-17 | N/A | 9.8 CRITICAL |
| Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /inquiries/view_inquiry.php. | |||||
| CVE-2023-30325 | 1 Chatengine Project | 1 Chatengine | 2026-06-17 | N/A | 7.5 HIGH |
| SQL Injection vulnerability in textMessage parameter in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine v.1.0, allows attackers to gain sensitive information. | |||||
| CVE-2023-30323 | 1 Chatengine Project | 1 Chatengine | 2026-06-17 | N/A | 7.5 HIGH |
| SQL Injection vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to gain sensitive information. | |||||
| CVE-2023-30246 | 1 Judging Management System Project | 1 Judging Management System | 2026-06-17 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_id parameter. | |||||
| CVE-2023-30245 | 1 Judging Management System Project | 1 Judging Management System | 2026-06-17 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id parameter of the edit_criteria.php file. | |||||
| CVE-2023-30211 | 1 Ourphp | 1 Ourphp | 2026-06-17 | N/A | 9.8 CRITICAL |
| OURPHP <= 7.2.0 is vulnerable to SQL Injection. | |||||
| CVE-2023-30204 | 1 Judging Management System Project | 1 Judging Management System | 2026-06-17 | N/A | 9.8 CRITICAL |
| Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the judge_id parameter at /php-jms/edit_judge.php. | |||||
| CVE-2023-30203 | 1 Judging Management System Project | 1 Judging Management System | 2026-06-17 | N/A | 9.8 CRITICAL |
| Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the event_id parameter at /php-jms/result_sheet.php. | |||||
| CVE-2023-30194 | 1 Prestashop | 1 Poststaticfooter | 2026-06-17 | N/A | 9.8 CRITICAL |
| Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook(). | |||||
| CVE-2023-30192 | 1 Prestashop | 1 Possearchproducts | 2026-06-17 | N/A | 9.8 CRITICAL |
| Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). | |||||
| CVE-2023-30191 | 1 Cdesigner Project | 1 Cdesigner | 2026-06-17 | N/A | 9.8 CRITICAL |
| PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent(). | |||||
| CVE-2023-30189 | 1 Posthemes | 1 Posstaticblocks | 2026-06-17 | N/A | 9.8 CRITICAL |
| Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook(). | |||||
| CVE-2023-30154 | 1 Shoprunners | 1 Aftermail | 2026-06-17 | N/A | 9.8 CRITICAL |
| Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via `id_customer`, `id_conf`, `id_product` and `token` parameters in `aftermailajax.php via the 'id_product' parameter in hooks DisplayRightColumnProduct and DisplayProductButtons. | |||||
| CVE-2023-30153 | 1 Prestashop | 1 Payplug | 2026-06-17 | N/A | 9.8 CRITICAL |
| An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.7.0 and 3.7.1, allows remote attackers to execute arbitrary SQL commands via the ajax.php front controller. | |||||
| CVE-2023-30151 | 1 Boxtal | 1 Envoimoinscher | 2026-06-17 | N/A | 9.8 CRITICAL |
| A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the `key` GET parameter. | |||||
| CVE-2023-30150 | 1 Leotheme | 1 Leocustomajax | 2026-06-17 | N/A | 9.8 CRITICAL |
| PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php. | |||||