Export limit exceeded: 51987 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 21746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,746

Export CSV
CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Cpanel
Products
Cpanel
CVE-2018-20779

Traq 3.7.1 allows SQL Injection via a tickets?search= URI.

CVSS 3.0 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Traq
Products
Traq
CVE-2018-20730

A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component.

CVSS 3.0 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Nedi
Products
Nedi
CVE-2018-20719

In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tiki
Products
Tikiwiki Cms\/groupware
CVE-2018-20716

CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature.

CVSS 3.0 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Cubecart
Products
Cubecart
CVE-2018-20715

The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Oxid-esales
Products
Eshop
CVE-2018-20713

Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.

CVSS 3.0 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Shopware
Products
Shopware
CVE-2018-20678

LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Librenms
Products
Librenms
CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893.

CVSS 3.0 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Wuzhicms
Products
Wuzhicms
CVE-2018-20508

CrashFix 1.0.4 has SQL Injection via the User[status] parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search() function.

CVSS 3.0 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Crashfix Project
Products
Crashfix
CVE-2018-20505

sqlite: Multiple flaws in sqlite which can be triggered via corrupted internal databases (Magellan)

SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).

CVSS 3.0 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Apple Microsoft Sqlite
Products
Icloud Iphone Os Itunes and 4 more
CVE-2018-20480

An issue was discovered in S-CMS 1.0. It allows SQL Injection via the js/pic.php P_id parameter.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
S-cms
Products
S-cms
CVE-2018-20479

An issue was discovered in S-CMS 1.0. It allows SQL Injection via the wap_index.php?type=newsinfo S_id parameter.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
S-cms
Products
S-cms
CVE-2018-20477

An issue was discovered in S-CMS 3.0. It allows SQL Injection via the bank/callback1.php P_no field.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
S-cms
Products
S-cms
CVE-2018-20469

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions.

CVSS 3.1 · 9.8 Critical EPSS 18.5% KEV · Not listed
Vendors
Sahipro
Products
Sahi Pro