Total
20788 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-0383 | 1 Ljapps | 1 Wp Review Slider | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attacks | |||||
| CVE-2022-0366 | 1 Capsule8 | 1 Capsule8 | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| An authenticated and authorized agent user could potentially gain administrative access via an SQLi vulnerability to Capsule8 Console between versions 4.6.0 and 4.9.1. | |||||
| CVE-2022-0362 | 1 Showdoc | 1 Showdoc | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection in Packagist showdoc/showdoc prior to 2.10.3. | |||||
| CVE-2022-0349 | 1 Wpdeveloper | 1 Notificationx | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection | |||||
| CVE-2022-0332 | 1 Moodle | 1 Moodle | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data. | |||||
| CVE-2022-0267 | 1 Adrotate Project | 1 Adrotate | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection | |||||
| CVE-2022-0258 | 1 Pimcore | 1 Pimcore | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command | |||||
| CVE-2022-0255 | 1 Deliciousbrains | 1 Database Backup | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue | |||||
| CVE-2022-0254 | 1 Highfivery | 1 Zero-spam | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection | |||||
| CVE-2022-0228 | 1 Sygnoos | 1 Popup Builder | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection | |||||
| CVE-2022-0224 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command | |||||
| CVE-2022-0190 | 1 Acnam | 1 Ad Invalid Click Protector | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action. | |||||
| CVE-2022-0169 | 1 10web | 1 Photo Gallery | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection | |||||
| CVE-2022-0153 | 1 Fork-cms | 1 Fork Cms | 2026-06-17 | 4.3 MEDIUM | 7.5 HIGH |
| SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1. | |||||
| CVE-2021-4458 | 1 Webnus | 1 Modern Events Calendar Lite | 2026-06-17 | N/A | 5.9 MEDIUM |
| The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled. | |||||
| CVE-2021-4450 | 1 Pickplugins | 1 Post Grid | 2026-06-17 | N/A | 8.8 HIGH |
| The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |||||
| CVE-2021-4340 | 1 Stylemixthemes | 1 Ulisting | 2026-06-17 | N/A | 9.8 CRITICAL |
| The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |||||
| CVE-2021-4336 | 1 Itrsgroup | 1 Ninja | 2026-06-17 | 5.2 MEDIUM | 5.5 MEDIUM |
| A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgrading to version 2021.11.30 is able to address this issue. The name of the patch is 6da9080faec9bca1ca5342386c0421dca0a6c0cc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230084. | |||||
| CVE-2021-4328 | 1 Lionfish Cms Project | 1 Lionfish Cms | 2026-06-17 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability has been found in 狮子鱼CMS and classified as critical. Affected by this vulnerability is the function goods_detail of the file ApiController.class.php. The manipulation of the argument goods_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222223. | |||||
| CVE-2021-4313 | 1 Nethserver-phonenehome Project | 1 Nethserver-phonenehome | 2026-06-17 | 5.2 MEDIUM | 5.5 MEDIUM |
| A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d493836bbdf695cf71624b377391. It is recommended to apply a patch to fix this issue. The identifier VDB-218393 was assigned to this vulnerability. | |||||