Total
20784 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-25491 | 1 Doditsolutions | 1 Airbnb Clone Script | 2026-06-17 | N/A | 8.2 HIGH |
| Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter. Attackers can send GET requests to the admin/cms_getpagetitle.php endpoint with malicious catid values to extract sensitive database information. | |||||
| CVE-2019-25490 | 1 Doditsolutions | 1 Airbnb Clone Script | 2026-06-17 | N/A | 8.2 HIGH |
| Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to the admin/edit.php endpoint with time-based SQL injection payloads to extract sensitive database information. | |||||
| CVE-2019-25489 | 1 Doditsolutions | 1 Airbnb Clone Script | 2026-06-17 | N/A | 8.2 HIGH |
| Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers can send GET requests to the rooms/ajax_refresh_subtotal endpoint with malicious hosting_id values to extract sensitive database information or cause denial of service. | |||||
| CVE-2019-25488 | 1 Jettweb | 1 Php Ready Rent A Car Site Script | 2026-06-17 | N/A | 8.2 HIGH |
| Jettweb Hazir Rent A Car Scripti V4 contains multiple SQL injection vulnerabilities in the admin panel that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into the 'tur', 'id', and 'ozellikdil' parameters of the admin/index.php endpoint to extract sensitive database information or cause denial of service. | |||||
| CVE-2019-25486 | 2026-06-17 | N/A | 8.2 HIGH | ||
| Varient 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user_id parameter. Attackers can submit POST requests with crafted SQL payloads in the user_id field to bypass authentication and extract sensitive database information. | |||||
| CVE-2019-25482 | 1 Jettweb | 1 Php Ready Rent A Car Site Script | 2026-06-17 | N/A | 8.2 HIGH |
| Jettweb PHP Hazir Rent A Car Sitesi Scripti V2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the arac_kategori_id parameter. Attackers can send POST requests to the endpoint with malicious SQL payloads to extract sensitive database information. | |||||
| CVE-2019-25481 | 2026-06-17 | N/A | 8.2 HIGH | ||
| iScripts ReserveLogic contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the jqSearchDestination parameter. Attackers can send POST requests to the search endpoint with crafted SQL payloads to extract sensitive database information. | |||||
| CVE-2019-25479 | 2026-06-17 | N/A | 8.2 HIGH | ||
| Inout RealEstate contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the city parameter. Attackers can send POST requests to the agents/agentlistdetails endpoint with malicious SQL payloads in the city parameter to extract sensitive database information. | |||||
| CVE-2019-25473 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Clinic Pro contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the month parameter. Attackers can send POST requests to the monthly_expense_overview endpoint with crafted month values using boolean-based blind, time-based blind, or error-based SQL injection techniques to extract sensitive database information. | |||||
| CVE-2019-25462 | 2026-06-17 | N/A | 8.2 HIGH | ||
| Web Ofisi Rent a Car v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'klima' parameter. Attackers can send GET requests to with malicious 'klima' values to extract sensitive database information or cause denial of service. | |||||
| CVE-2019-25461 | 1 Web-ofisi | 1 Platinum E-ticaret | 2026-06-17 | N/A | 7.5 HIGH |
| Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' parameter. Attackers can send POST requests to the ajax/productsFilterSearch endpoint with malicious 'q' values using time-based blind SQL injection techniques to extract sensitive database information. | |||||
| CVE-2019-25460 | 1 Web-ofisi | 1 Platinum E-ticaret | 2026-06-17 | N/A | 7.5 HIGH |
| Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' GET parameter. Attackers can send requests to the arama endpoint with malicious 'q' values using time-based SQL injection techniques to extract sensitive database information. | |||||
| CVE-2019-25459 | 1 Web-ofisi | 1 Emlak | 2026-06-17 | N/A | 9.8 CRITICAL |
| Web Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into parameters like emlak_durumu, emlak_tipi, il, ilce, kelime, and semt to extract sensitive database information or perform time-based blind SQL injection attacks. | |||||
| CVE-2019-25458 | 1 Web-ofisi | 1 Firma Rehberi | 2026-06-17 | N/A | 9.8 CRITICAL |
| Web Ofisi Firma Rehberi v1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can send requests to with malicious payloads in the 'il', 'kat', or 'kelime' parameters to extract sensitive database information or perform time-based blind SQL injection attacks. | |||||
| CVE-2019-25457 | 1 Web-ofisi | 1 Firma | 2026-06-17 | N/A | 7.5 HIGH |
| Web Ofisi Firma v13 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'oz' array parameter. Attackers can send GET requests to category pages with malicious 'oz[]' values using time-based blind SQL injection payloads to extract sensitive database information. | |||||
| CVE-2019-25456 | 1 Web-ofisi | 1 Emlak | 2026-06-17 | N/A | 9.1 CRITICAL |
| Web Ofisi Emlak v2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'ara' GET parameter. Attackers can send requests to with time-based SQL injection payloads to extract sensitive database information or cause denial of service. | |||||
| CVE-2019-25455 | 1 Web-ofisi | 1 E-ticaret | 2026-06-17 | N/A | 7.5 HIGH |
| Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'a' parameter. Attackers can send GET requests to with malicious 'a' parameter values to extract sensitive database information. | |||||
| CVE-2019-25452 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-06-17 | N/A | 7.5 HIGH |
| Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted POST requests with malicious SQL payloads in the elemid parameter to extract sensitive database information using error-based or time-based blind SQL injection techniques. | |||||
| CVE-2019-25450 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-06-17 | N/A | 7.5 HIGH |
| Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques. | |||||
| CVE-2019-25446 | 2026-06-17 | N/A | 8.2 HIGH | ||
| DIGIT CENTRIS ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the datum1, datum2, KID, and PID parameters. Attackers can send POST requests to /korisnikinfo.php with malicious SQL syntax in these parameters to extract or modify sensitive database information. | |||||